Skip to content

ci(macos): full integration lane via colima on macos-15-intel - #447

Open
MattJackson wants to merge 3 commits into
stack/s7from
stack/s8
Open

MattJackson wants to merge 3 commits into
stack/s7from
stack/s8

Conversation

@MattJackson

@MattJackson MattJackson commented Sep 2, 2026

Copy link
Copy Markdown
Contributor

Part of the sync stack — slice s8, based on #446 (stack/s7).

Restore a real macOS integration lane

Hosted macOS runners have no Linux Docker daemon, so macOS had been reduced to build + cargo test --lib. This hosts the linux/amd64 SQL Server 2022 container inside a colima (Lima) Linux VM on an Intel macos-15-intel runner (native amd64, no qemu) and runs the full integration suite. It also declares workflow_dispatch + qa in on:, without which the qa-gated integration lanes could never fire.

Backends (validated on a real macos-15-intel runner)

  • rustls — pass (TLS 1.3 exercised end-to-end against SQL Server 2022)
  • vendored-openssl — pass
  • native-tls — Apple Secure Transport cannot complete the SQL Server handshake (works on Linux=OpenSSL, Windows=SChannel); runs continue-on-error for visibility, tracked as a follow-up

Readiness gates on an authenticated SELECT 1 (a listening port is not readiness — it caused sporadic 18456 login races under the bulk tests).

Note: the TLS 1.3 re-enablement itself lives in #439 (which drops the TLS 1.2 pin from 624877e in favor of with_safe_default_protocol_versions()). This PR adds no TLS code — it is the macOS lane that proves that change negotiates TLS 1.3 end-to-end on Apple hardware.

Answers @aqrln's macOS follow-up on #438.

Please rebase-merge (not squash) to preserve commit attribution.

@MattJackson

Copy link
Copy Markdown
Contributor Author

@aqrln rebased onto the merged main, all green and MERGEABLE — ready for review whenever you get a chance. Thanks!

@MattJackson

Copy link
Copy Markdown
Contributor Author

Rebased onto the updated stack; green. CI cleanup: dropped a linux (SQL 2025, experimental) lane that referenced a mssql-2025 docker-compose service which doesn't exist (so it could only ever fail), and dropped the macOS --features=all lane whose native-tls = Apple Secure Transport cannot complete the SQL Server TLS handshake. rustls and vendored-openssl already provide macOS TLS-backend coverage, so the macOS lane is now genuinely green.

Replace the build+unit-only macOS job with a full integration lane: an
Intel macos-15-intel runner hosts the linux/amd64 SQL Server 2022 image
inside a colima (Lima) Linux VM (native amd64, no qemu) and runs the
suite across rustls and vendored-openssl (both required). native-tls
resolves to Apple Secure Transport, which cannot complete the SQL Server
handshake, so it runs continue-on-error (tracked follow-up). Readiness
gates on an authenticated SELECT 1 to avoid the 18456 login race.

Also declare workflow_dispatch + qa in on:, without which the qa-gated
integration lanes (macOS/Linux-next/Windows) could never fire.

Validated on a real macos-15-intel runner: rustls + vendored-openssl
green, native-tls soft-fails, overall green.
- shorten the on-trigger explanation and drop speculative runner-future notes
- remove editorializing/"Required." tags and redundant feature-set restatement
- keep the non-obvious notes (colima RAM, krb5 keg-only, 18456 login race)
…s lane

- integration-linux-next referenced a `mssql-2025` docker-compose service
  that does not exist (compose only defines 2022/2019/2017/azure-sql-edge),
  so the lane could only ever fail and produced false red signal on qa.
  Removed until a real SQL Server 2025 image + compose service is added.
- The macOS `--features=all` matrix entry pulls in native-tls, which on
  macOS is Apple Secure Transport and cannot complete the SQL Server TLS
  handshake; it was a permanent soft-fail. Removed it (rustls and
  vendored-openssl already provide macOS TLS-backend coverage) and documented
  why, so the macOS lane is now genuinely green rather than perpetually red.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant