chore(ci): use Blacksmith macOS runners

[spydon]

Moves every macOS CI job from GitHub-hosted macos-latest to blacksmith-6vcpu-macos-latest, mirroring supabase/supabase-swift#1185.

Jobs migrated

• .github/workflows/build.yml: Build macos, Build ios
• .github/workflows/test.yml: Flutter v3.35.x on macos-latest, Flutter Latest on macos-latest
• .github/workflows/example-integration-tests.yml: macos, ios

Ubuntu and Windows jobs are untouched.

Implementation note

In build.yml and test.yml the os matrix key feeds both the job display name and several step conditions, so a separate runner key was added and runs-on points at that instead. Job names stay byte-identical, so required status checks in branch protection keep matching. example-integration-tests.yml only conditions on matrix.target, so its os value was swapped directly.

A .github/actionlint.yaml registers the Blacksmith label, since actionlint cannot discover labels that come from a GitHub App and would otherwise flag every runs-on here.

Measured effect

Median duration of the GitHub-hosted jobs over the last two days of runs, against this branch's first run:

Job	GitHub-hosted (median)	Blacksmith	Change
Build macos	237s	123s	1.9x faster
Build ios	232s	125s	1.9x faster
Flutter v3.35.x on macos	156s	88s	1.8x faster
Flutter Latest on macos	183s	93s	2.0x faster

Queue time went up slightly, from 2 to 4 seconds to 13 to 22 seconds, which the runtime saving absorbs several times over.

Still unexercised

Example integration tests is gated behind a release title or the integration tests label, so the macos and ios simulator jobs did not run here. Those boot a simulator with xcrun simctl erase/boot, which is the most likely step to behave differently on a Blacksmith image, so the label is worth applying once before merge.

Closes SDK-1466

Summary by CodeRabbit

• Chores
  • Updated build, test, and integration-test workflows to use explicitly mapped platform-specific runners.
  • macOS and iOS validation now runs on dedicated macOS environments, while Windows and Linux continue using their existing runners.
  • Improved workflow configuration and validation consistency across supported platforms.
  • Added configuration support for the dedicated macOS runner label.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 0ee19323-c7a5-4254-a844-487cd1f70114

📥 Commits

Reviewing files that changed from the base of the PR and between 9be7f9e and acae3cd.

📒 Files selected for processing (1)

• .github/actionlint.yaml

---

📝 Walkthrough

Walkthrough

The CI workflows now assign explicit runners per matrix entry. macOS and iOS jobs use Blacksmith macOS runners. Ubuntu and Windows jobs retain their existing GitHub-hosted runners. Actionlint recognizes the Blacksmith runner label.

Changes

CI runner routing

Layer / File(s)	Summary
Workflow runner matrix updates .github/workflows/build.yml, .github/workflows/test.yml, .github/workflows/example-integration-tests.yml, .github/actionlint.yaml	Build and Flutter test matrices now use explicit runner values. macOS and iOS integration tests use blacksmith-6vcpu-macos-latest. Jobs run on matrix.runner. Actionlint defines the Blacksmith runner label.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: dshukertjr

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the primary change: migrating macOS CI jobs to Blacksmith runners.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch lukasklingsbo/sdk-1466-choreci-use-blacksmith-macos-runners-in-supabase-flutter

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🧹 Nitpick comments (1)

.github/workflows/example-integration-tests.yml (1)

127-128: 🔒 Security & Privacy | 🔵 Trivial

Verify Blacksmith runner isolation for pull-request jobs.

If this workflow runs untrusted pull requests, confirm that the runner is ephemeral and isolated per job. The workflow checks out repository code and exposes GH_TOKEN from ${{ secrets.GITHUB_TOKEN }}. A shared persistent runner could expose workspaces, caches, or tokens to later jobs.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/example-integration-tests.yml around lines 127 - 128,
Verify that the Blacksmith runner used by the macos and ios matrix jobs is
ephemeral and isolated per job, given that the workflow checks out untrusted
pull-request code and exposes GH_TOKEN. Update the runner configuration or
workflow to enforce clean per-job isolation, and preserve the existing targets.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/build.yml:
- Line 83: Add blacksmith-6vcpu-macos-latest to the allowed runner labels in
actionlint.yaml, and ensure the Blacksmith GitHub App exposes that identical
label for the organization. This root-cause configuration change covers the
usages in .github/workflows/build.yml lines 83-83 and 86-86,
.github/workflows/test.yml line 244-244, and
.github/workflows/example-integration-tests.yml lines 127-128; no direct
workflow changes are required.

---

Nitpick comments:
In @.github/workflows/example-integration-tests.yml:
- Around line 127-128: Verify that the Blacksmith runner used by the macos and
ios matrix jobs is ephemeral and isolated per job, given that the workflow
checks out untrusted pull-request code and exposes GH_TOKEN. Update the runner
configuration or workflow to enforce clean per-job isolation, and preserve the
existing targets.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 2085ad42-e729-4cb2-be69-fa5a378132a3

📥 Commits

Reviewing files that changed from the base of the PR and between 85ec6dc and 9be7f9e.

📒 Files selected for processing (3)

• .github/workflows/build.yml
• .github/workflows/example-integration-tests.yml
• .github/workflows/test.yml