From d26d3fcb95b75e9fdc3acb53529e97a1a14cc3c6 Mon Sep 17 00:00:00 2001
From: Brad Fitzpatrick <bradfitz@tailscale.com>
Date: Mon, 9 Feb 2026 13:25:07 -0800
Subject: [PATCH] .github/workflows: add macos runner

Fixes #18118

Change-Id: I118fcc6537af9ccbdc7ce6b78134e8059b0b5ccf
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
---
 .github/workflows/test.yml  | 62 ++++++++++++++++++++++++++++++++++++-
 logtail/filch/filch_test.go | 14 +++++++++
 ssh/tailssh/tailssh_test.go |  3 ++
 3 files changed, 78 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index a6906e53e..152ef7bce 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -300,6 +300,63 @@ jobs:
       working-directory: src
       run: ./tool/go version
 
+  macos:
+    runs-on: macos-latest
+    needs: gomod-cache
+    steps:
+    - name: checkout
+      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      with:
+        path: src
+    - name: Restore Go module cache
+      uses: actions/cache/restore@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
+      with:
+        path: gomodcache
+        key: ${{ needs.gomod-cache.outputs.cache-key }}
+        enableCrossOsArchive: true
+    - name: Restore Cache
+      id: restore-cache
+      uses: actions/cache/restore@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
+      with:
+        path: ~/Library/Caches/go-build
+        key: ${{ runner.os }}-go-test-${{ hashFiles('**/go.sum') }}-${{ github.job }}-${{ github.run_id }}
+        restore-keys: |
+          ${{ runner.os }}-go-test-${{ hashFiles('**/go.sum') }}-${{ github.job }}-
+          ${{ runner.os }}-go-test-${{ hashFiles('**/go.sum') }}-
+          ${{ runner.os }}-go-test-
+    - name: build test wrapper
+      working-directory: src
+      run: ./tool/go build -o /tmp/testwrapper ./cmd/testwrapper
+    - name: test all
+      working-directory: src
+      run: PATH=$PWD/tool:$PATH /tmp/testwrapper ./...
+    - name: check that no tracked files changed
+      working-directory: src
+      run: git diff --no-ext-diff --name-only --exit-code || (echo "Build/test modified the files above."; exit 1)
+    - name: check that no new files were added
+      working-directory: src
+      run: |
+        # Note: The "error: pathspec..." you see below is normal!
+        # In the success case in which there are no new untracked files,
+        # git ls-files complains about the pathspec not matching anything.
+        # That's OK. It's not worth the effort to suppress. Please ignore it.
+        if git ls-files --others --exclude-standard --directory --no-empty-directory --error-unmatch -- ':/*'
+        then
+          echo "Build/test created untracked files in the repo (file names above)."
+          exit 1
+        fi
+    - name: Tidy cache
+      working-directory: src
+      run: |
+        find $(./tool/go env GOCACHE) -type f -mmin +90 -delete
+    - name: Save Cache
+      # Save cache even on failure, but only on cache miss and main branch to avoid thrashing.
+      if: always() && steps.restore-cache.outputs.cache-hit != 'true' && github.ref == 'refs/heads/main'
+      uses: actions/cache/save@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
+      with:
+        path: ~/Library/Caches/go-build
+        key: ${{ runner.os }}-go-test-${{ hashFiles('**/go.sum') }}-${{ github.job }}-${{ github.run_id }}
+
   privileged:
     needs: gomod-cache
     runs-on: ubuntu-24.04
@@ -851,10 +908,11 @@ jobs:
   notify_slack:
     if: always()
     # Any of these jobs failing causes a slack notification.
-    needs: 
+    needs:
       - android
       - test
       - windows
+      - macos
       - vm
       - cross
       - ios
@@ -900,6 +958,7 @@ jobs:
       - android
       - test
       - windows
+      - macos
       - vm
       - cross
       - ios
@@ -949,6 +1008,7 @@ jobs:
       - check_mergeability_strict
       - test
       - windows
+      - macos
       - vm
       - wasm
       - fuzz
diff --git a/logtail/filch/filch_test.go b/logtail/filch/filch_test.go
index 2538233cf..f2f9e9e3b 100644
--- a/logtail/filch/filch_test.go
+++ b/logtail/filch/filch_test.go
@@ -5,6 +5,7 @@ package filch
 
 import (
 	"bytes"
+	"crypto/sha256"
 	"encoding/json"
 	"fmt"
 	"io"
@@ -120,7 +121,19 @@ func setupStderr(t *testing.T) {
 	tstest.Replace(t, &os.Stderr, pipeW)
 }
 
+func skipDarwin(t testing.TB) {
+	if runtime.GOOS != "darwin" {
+		return
+	}
+	src := must.Get(os.ReadFile("filch.go"))
+	if fmt.Sprintf("%x", sha256.Sum256(src)) != "a32da5e22034823c19ac7f29960e3646f540d67f85a0028832cab1f1557fc693" {
+		t.Errorf("filch.go has changed since this test was skipped; please delete this skip")
+	}
+	t.Skip("skipping known failing test on darwin; fixed in progress by https://github.com/tailscale/tailscale/pull/18660")
+}
+
 func TestConcurrentWriteAndRead(t *testing.T) {
+	skipDarwin(t)
 	if replaceStderrSupportedForTest {
 		setupStderr(t)
 	}
@@ -283,6 +296,7 @@ func TestMaxLineSize(t *testing.T) {
 }
 
 func TestMaxFileSize(t *testing.T) {
+	skipDarwin(t)
 	if replaceStderrSupportedForTest {
 		t.Run("ReplaceStderr:true", func(t *testing.T) { testMaxFileSize(t, true) })
 	}
diff --git a/ssh/tailssh/tailssh_test.go b/ssh/tailssh/tailssh_test.go
index f91cbafe7..44db0cc00 100644
--- a/ssh/tailssh/tailssh_test.go
+++ b/ssh/tailssh/tailssh_test.go
@@ -495,6 +495,9 @@ func TestSSHRecordingCancelsSessionsOnUploadFailure(t *testing.T) {
 	if runtime.GOOS != "linux" && runtime.GOOS != "darwin" {
 		t.Skipf("skipping on %q; only runs on linux and darwin", runtime.GOOS)
 	}
+	if runtime.GOOS == "darwin" && cibuild.On() {
+		t.Skipf("this fails on CI on macOS; see https://github.com/tailscale/tailscale/issues/7707")
+	}
 
 	var handler http.HandlerFunc
 	recordingServer := mockRecordingServer(t, func(w http.ResponseWriter, r *http.Request) {