Skip to content

Commit 9e6e59b

Browse files
fkorotkov-oaifkorotkov-oai
authored
[codex] Publish Tart to openai/homebrew-tools (#1277)
* Publish Tart to openai/homebrew-tools * Write Tart formula under Formula directory * Use macOS 26 runners * docs: install Tart tools from OpenAI tap * Add required GitHub Actions test check * Fix hosted tests and notarization credentials
1 parent 32d084e commit 9e6e59b

17 files changed

Lines changed: 213 additions & 108 deletions

‎.ci/build-release.sh‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
#!/bin/sh
2+
3+
set -eu
4+
5+
ARCH="$1"
6+
SCRATCH_PATH=".build/$ARCH"
7+
OUTPUT_PATH=".build/prebuilt/$ARCH"
8+
9+
swift build \
10+
--build-system swiftbuild \
11+
--scratch-path "$SCRATCH_PATH" \
12+
--arch "$ARCH" \
13+
--configuration release \
14+
--product tart
15+
16+
BIN_PATH=$(swift build \
17+
--build-system swiftbuild \
18+
--scratch-path "$SCRATCH_PATH" \
19+
--arch "$ARCH" \
20+
--configuration release \
21+
--show-bin-path)
22+
23+
mkdir -p "$OUTPUT_PATH"
24+
cp "$BIN_PATH/tart" "$OUTPUT_PATH/tart"

‎.ci/create-pkg.sh‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22

33
set -e
44

5-
export VERSION="${CIRRUS_TAG:-0}"
5+
export VERSION="${VERSION:-0}"
66

77
mkdir -p .ci/pkg/
88
cp .build/arm64-apple-macosx/release/tart .ci/pkg/tart

‎.ci/set-version.sh‎

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,11 @@
11
#!/bin/sh
22

3+
set -e
4+
5+
: "${VERSION:?VERSION must be set}"
6+
37
TMPFILE=$(mktemp)
4-
envsubst < Sources/tart/CI/CI.swift > $TMPFILE
5-
mv $TMPFILE Sources/tart/CI/CI.swift
8+
perl -pe 's/\$\{VERSION\}/$ENV{VERSION}/g' Sources/tart/CI/CI.swift > "$TMPFILE"
9+
mv "$TMPFILE" Sources/tart/CI/CI.swift
610

7-
/usr/libexec/PlistBuddy -c "Add :CFBundleShortVersionString string ${CIRRUS_TAG}" Resources/Info.plist
11+
/usr/libexec/PlistBuddy -c "Add :CFBundleShortVersionString string ${VERSION}" Resources/Info.plist

‎.ci/sign-release.sh‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
#!/bin/sh
2+
3+
set -eu
4+
5+
if [ "${TART_RELEASE_SNAPSHOT:-false}" = "true" ]; then
6+
codesign \
7+
--force \
8+
--deep \
9+
--sign - \
10+
--entitlements Resources/tart-dev.entitlements \
11+
dist/tart_darwin_all/tart.app
12+
else
13+
gon gon.hcl
14+
fi

‎.cirrus.yml‎

Lines changed: 0 additions & 85 deletions
Original file line numberDiff line numberDiff line change
@@ -63,91 +63,6 @@ task:
6363
binary_artifacts:
6464
path: .build/$BUILD_ARCH-apple-macosx/debug/tart
6565

66-
task:
67-
only_if: $CIRRUS_TAG == '' && ($CIRRUS_USER_PERMISSION == 'write' || $CIRRUS_USER_PERMISSION == 'admin')
68-
name: Release (Dry Run)
69-
depends_on:
70-
- lint
71-
- build
72-
macos_instance:
73-
image: ghcr.io/cirruslabs/macos-runner:tahoe
74-
env:
75-
MACOS_CERTIFICATE: ENCRYPTED[552b9d275d1c2bdbc1bff778b104a8f9a53cbd0d59344d4b7f6d0ca3c811a5cefb97bef9ba0ef31c219cb07bdacdd2c2]
76-
AC_PASSWORD: ENCRYPTED[4a761023e7e06fe2eb350c8b6e8e7ca961af193cb9ba47605f25f1d353abc3142606f412e405be48fd897a78787ea8c2]
77-
GITHUB_TOKEN: ENCRYPTED[!98ace8259c6024da912c14d5a3c5c6aac186890a8d4819fad78f3e0c41a4e0cd3a2537dd6e91493952fb056fa434be7c!]
78-
GORELEASER_KEY: ENCRYPTED[!9b80b6ef684ceaf40edd4c7af93014ee156c8aba7e6e5795f41c482729887b5c31f36b651491d790f1f668670888d9fd!]
79-
setup_script:
80-
- cd $HOME
81-
- echo $MACOS_CERTIFICATE | base64 --decode > certificate.p12
82-
- security create-keychain -p password101 build.keychain
83-
- security default-keychain -s build.keychain
84-
- security unlock-keychain -p password101 build.keychain
85-
- security import certificate.p12 -k build.keychain -P password101 -T /usr/bin/codesign -T /usr/bin/pkgbuild
86-
- security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k password101 build.keychain
87-
- xcrun notarytool store-credentials "notarytool" --apple-id "hello@cirruslabs.org" --team-id "9M2P8L4D89" --password $AC_PASSWORD
88-
install_script:
89-
- brew install go
90-
- brew install mitchellh/gon/gon
91-
- brew install --cask goreleaser/tap/goreleaser-pro
92-
info_script:
93-
- security find-identity -v
94-
- xcodebuild -version
95-
- swift -version
96-
goreleaser_script: goreleaser release --skip=publish --snapshot --clean
97-
always:
98-
dist_artifacts:
99-
path: "dist/*"
100-
101-
task:
102-
name: Release
103-
only_if: $CIRRUS_TAG != ''
104-
depends_on:
105-
- lint
106-
- build
107-
macos_instance:
108-
image: ghcr.io/cirruslabs/macos-runner:tahoe
109-
env:
110-
MACOS_CERTIFICATE: ENCRYPTED[552b9d275d1c2bdbc1bff778b104a8f9a53cbd0d59344d4b7f6d0ca3c811a5cefb97bef9ba0ef31c219cb07bdacdd2c2]
111-
AC_PASSWORD: ENCRYPTED[4a761023e7e06fe2eb350c8b6e8e7ca961af193cb9ba47605f25f1d353abc3142606f412e405be48fd897a78787ea8c2]
112-
GITHUB_TOKEN: ENCRYPTED[!98ace8259c6024da912c14d5a3c5c6aac186890a8d4819fad78f3e0c41a4e0cd3a2537dd6e91493952fb056fa434be7c!]
113-
GORELEASER_KEY: ENCRYPTED[!9b80b6ef684ceaf40edd4c7af93014ee156c8aba7e6e5795f41c482729887b5c31f36b651491d790f1f668670888d9fd!]
114-
SENTRY_ORG: cirrus-labs
115-
SENTRY_PROJECT: persistent-workers
116-
SENTRY_AUTH_TOKEN: ENCRYPTED[!9eaf2875d51b113e2f68598441ff8e6b2e53242e48fcb93633bd75a373fbe2e7caa900d837cc92f0b142b65579731644!]
117-
setup_script:
118-
- cd $HOME
119-
- echo $MACOS_CERTIFICATE | base64 --decode > certificate.p12
120-
- security create-keychain -p password101 build.keychain
121-
- security default-keychain -s build.keychain
122-
- security unlock-keychain -p password101 build.keychain
123-
- security import certificate.p12 -k build.keychain -P password101 -T /usr/bin/codesign -T /usr/bin/pkgbuild
124-
- security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k password101 build.keychain
125-
- xcrun notarytool store-credentials "notarytool" --apple-id "hello@cirruslabs.org" --team-id "9M2P8L4D89" --password $AC_PASSWORD
126-
install_script:
127-
- brew install go getsentry/tools/sentry-cli
128-
- brew install mitchellh/gon/gon
129-
- brew install --cask goreleaser/tap/goreleaser-pro
130-
info_script:
131-
- security find-identity -v
132-
- xcodebuild -version
133-
- swift -version
134-
release_script: goreleaser
135-
upload_sentry_debug_files_script:
136-
- cd .build/arm64-apple-macosx/release/
137-
# Generate and upload symbols
138-
- dsymutil tart
139-
- sentry-cli debug-files upload tart.dSYM/
140-
- SENTRY_PROJECT=tart sentry-cli debug-files upload tart.dSYM/
141-
# Bundle and upload sources
142-
- sentry-cli debug-files bundle-sources tart.dSYM
143-
- sentry-cli debug-files upload tart.src.zip
144-
- SENTRY_PROJECT=tart sentry-cli debug-files upload tart.src.zip
145-
create_sentry_release_script:
146-
- export SENTRY_RELEASE="tart@$CIRRUS_TAG"
147-
- sentry-cli releases new $SENTRY_RELEASE
148-
- sentry-cli releases set-commits $SENTRY_RELEASE --auto
149-
- sentry-cli releases finalize $SENTRY_RELEASE
150-
15166
task:
15267
name: Deploy Documentation
15368
only_if: $CIRRUS_BRANCH == 'main'

‎.github/workflows/build.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ permissions:
99
jobs:
1010
build_cached:
1111
name: Build tart (cached)
12-
runs-on: ghcr.io/cirruslabs/macos-runner:tahoe
12+
runs-on: macos-26
1313
timeout-minutes: 30
1414
steps:
1515
- uses: actions/checkout@v5
@@ -29,7 +29,7 @@ jobs:
2929
3030
build_no_cache:
3131
name: Build tart (no cache)
32-
runs-on: ghcr.io/cirruslabs/macos-runner:tahoe
32+
runs-on: macos-26
3333
timeout-minutes: 30
3434
steps:
3535
- uses: actions/checkout@v5

‎.github/workflows/ci.yml‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
name: CI
2+
3+
on:
4+
merge_group:
5+
pull_request:
6+
push:
7+
branches:
8+
- main
9+
workflow_dispatch:
10+
11+
permissions:
12+
contents: read
13+
14+
jobs:
15+
test:
16+
name: Test
17+
runs-on: macos-26
18+
timeout-minutes: 60
19+
steps:
20+
- uses: actions/checkout@v6
21+
- uses: actions/setup-go@v6
22+
with:
23+
go-version-file: integration-tests/go.mod
24+
cache-dependency-path: integration-tests/go.sum
25+
- name: Build
26+
run: swift build --build-system swiftbuild
27+
- name: Run unit tests
28+
run: |
29+
export PATH="$PATH:/usr/sbin"
30+
swift test --build-system swiftbuild
31+
# The Python suite boots Tart VMs, but hosted ARM macOS runners do not support nested virtualization.
32+
- name: Run OpenTelemetry integration tests
33+
run: |
34+
bin_path="$(swift build --build-system swiftbuild --show-bin-path)"
35+
codesign --sign - --entitlements Resources/tart-dev.entitlements --force "$bin_path/tart"
36+
cd integration-tests
37+
PATH="$bin_path:$PATH" go test -v ./...

‎.github/workflows/release.yml‎

Lines changed: 106 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,106 @@
1+
name: Release
2+
3+
on:
4+
push:
5+
tags:
6+
- "*"
7+
workflow_dispatch:
8+
9+
permissions:
10+
contents: read
11+
12+
jobs:
13+
release:
14+
if: github.event_name == 'push' && github.repository == 'openai/tart'
15+
name: Release
16+
runs-on: macos-26
17+
environment: publish
18+
timeout-minutes: 90
19+
permissions:
20+
contents: read
21+
env:
22+
VERSION: ${{ github.ref_name }}
23+
steps:
24+
- name: Checkout
25+
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
26+
with:
27+
fetch-depth: 0
28+
persist-credentials: false
29+
- name: Import signing certificate
30+
env:
31+
KEYCHAIN_PASSWORD: temporary-password
32+
MACOS_CERTIFICATE: ${{ secrets.MACOS_CERTIFICATE }}
33+
P12_PASSWORD: password101
34+
run: |
35+
echo "$MACOS_CERTIFICATE" | base64 --decode > "$RUNNER_TEMP/certificate.p12"
36+
security create-keychain -p "$KEYCHAIN_PASSWORD" "$RUNNER_TEMP/build.keychain"
37+
security default-keychain -s "$RUNNER_TEMP/build.keychain"
38+
security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$RUNNER_TEMP/build.keychain"
39+
security import "$RUNNER_TEMP/certificate.p12" \
40+
-k "$RUNNER_TEMP/build.keychain" \
41+
-P "$P12_PASSWORD" \
42+
-T /usr/bin/codesign \
43+
-T /usr/bin/pkgbuild
44+
security set-key-partition-list \
45+
-S apple-tool:,apple:,codesign: \
46+
-s \
47+
-k "$KEYCHAIN_PASSWORD" \
48+
"$RUNNER_TEMP/build.keychain"
49+
- name: Install gon
50+
run: brew install mitchellh/gon/gon
51+
- name: Create release app token for this repo
52+
id: app-token
53+
uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
54+
with:
55+
app-id: ${{ secrets.RELEASE_APP_ID }}
56+
private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
57+
permission-contents: write
58+
- name: Create release app token for homebrew-tools
59+
id: tap-token
60+
uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
61+
with:
62+
app-id: ${{ secrets.RELEASE_APP_ID }}
63+
private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
64+
owner: openai
65+
repositories: homebrew-tools
66+
permission-contents: write
67+
permission-pull-requests: write
68+
- name: Release
69+
uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7
70+
with:
71+
distribution: goreleaser-pro
72+
version: "~> v2"
73+
args: release --clean
74+
env:
75+
AC_PASSWORD: ${{ secrets.AC_PASSWORD }}
76+
GORELEASER_KEY: ${{ secrets.GORELEASER_KEY }}
77+
GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
78+
HOMEBREW_TAP_GITHUB_TOKEN: ${{ steps.tap-token.outputs.token }}
79+
80+
snapshot:
81+
if: github.event_name == 'workflow_dispatch'
82+
name: Release (Dry Run)
83+
runs-on: macos-26
84+
timeout-minutes: 90
85+
permissions:
86+
contents: read
87+
env:
88+
TART_RELEASE_SNAPSHOT: "true"
89+
VERSION: snapshot
90+
steps:
91+
- name: Checkout
92+
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
93+
with:
94+
fetch-depth: 0
95+
persist-credentials: false
96+
- name: Build snapshot
97+
uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7
98+
with:
99+
distribution: goreleaser-pro
100+
version: "~> v2"
101+
args: release --skip=publish --snapshot --clean
102+
- name: Upload snapshot artifacts
103+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
104+
with:
105+
name: tart-snapshot
106+
path: dist/*

‎.goreleaser.yml‎

Lines changed: 14 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -5,8 +5,8 @@ project_name: tart
55
before:
66
hooks:
77
- .ci/set-version.sh
8-
- swift build --arch arm64 --configuration release --product tart
9-
- swift build --arch x86_64 --configuration release --product tart
8+
- sh .ci/build-release.sh arm64
9+
- sh .ci/build-release.sh x86_64
1010

1111
builds:
1212
- id: tart
@@ -19,7 +19,7 @@ builds:
1919
- amd64
2020
binary: tart.app/Contents/MacOS/tart
2121
prebuilt:
22-
path: '.build/{{- if eq .Arch "arm64" }}arm64{{- else }}x86_64{{ end }}-apple-macosx/release/tart'
22+
path: '.build/prebuilt/{{- if eq .Arch "arm64" }}arm64{{- else }}x86_64{{ end }}/tart'
2323

2424
universal_binaries:
2525
- name_template: tart.app/Contents/MacOS/tart
@@ -30,7 +30,7 @@ universal_binaries:
3030
- cp Resources/embedded.provisionprofile dist/tart_darwin_all/tart.app/Contents/
3131
- cp Resources/Info.plist dist/tart_darwin_all/tart.app/Contents/
3232
- cp "Resources/actool/UPW Tart.icns" "Resources/actool/Assets.car" dist/tart_darwin_all/tart.app/Contents/Resources/
33-
- gon gon.hcl
33+
- .ci/sign-release.sh
3434

3535
archives:
3636
- name_template: "{{ .ProjectName }}"
@@ -52,22 +52,27 @@ release:
5252

5353
brews:
5454
- name: tart
55+
directory: Formula
5556
repository:
56-
owner: cirruslabs
57-
name: homebrew-cli
57+
owner: openai
58+
name: homebrew-tools
59+
token: "{{ .Env.HOMEBREW_TAP_GITHUB_TOKEN }}"
60+
branch: "tart-{{ .Version }}"
61+
pull_request:
62+
enabled: true
5863
caveats: |
5964
Tart has been installed. You might want to reduce the default DHCP lease time
6065
from 86,400 to 600 seconds to avoid DHCP shortage when running lots of VMs daily:
6166
6267
sudo defaults write /Library/Preferences/SystemConfiguration/com.apple.InternetSharing.default.plist bootpd -dict DHCPLeaseTimeSecs -int 600
6368
6469
See https://tart.run/faq/#changing-the-default-dhcp-lease-time for more details.
65-
homepage: https://github.com/cirruslabs/tart
66-
license: "Fair Source"
70+
homepage: https://github.com/openai/tart
71+
license: FSL-1.1-ALv2
6772
description: Run macOS and Linux VMs on Apple Hardware
6873
skip_upload: auto
6974
dependencies:
70-
- "cirruslabs/cli/softnet"
75+
- "openai/tools/softnet"
7176
install: |
7277
libexec.install Dir["*"]
7378
bin.write_exec_script "#{libexec}/tart.app/Contents/MacOS/tart"

‎README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -50,7 +50,7 @@ Many companies are using Tart in their internal setups. Here are just a few of t
5050
Try running a Tart VM on your Apple Silicon device running macOS 13.0 (Ventura) or later (will download a 25 GB image):
5151

5252
```bash
53-
brew install cirruslabs/cli/tart
53+
brew install openai/tools/tart
5454
tart clone ghcr.io/cirruslabs/macos-tahoe-base:latest tahoe-base
5555
tart run tahoe-base
5656
```

0 commit comments

Comments
 (0)