Grant CloudCurator access to isolated public macOS CI runners

[jmcte]

Updated incident

OMT-Global/cloudcurator is now public. Public pull-request code must not run on the persistent private runner pool described in the original incident. CloudCurator PR #33 now follows the APW-CLI public-pool trust pattern while retaining the native macOS/Xcode requirements:

["self-hosted", "public", "macOS", "ARM64", "xcode"]

Current evidence:

• CloudCurator PR feat: add synology deployment status surface #33: https://github.com/OMT-Global/cloudcurator/pull/33
• run 29210924080 / job 86698378070
• the job API reports the requested labels above, but runner_name and runner_group_name are null
• GET /repos/OMT-Global/cloudcurator/actions/runners returns no repository-visible runners
• the former hosted macos-14 run remained queued and was cancelled when the corrected workflow was pushed

This is now a public macOS runner-group access or pool-availability blocker. Do not grant public PR code access to the persistent private pool.

Required change

Grant OMT-Global/cloudcurator access to an isolated public macOS ARM64/Xcode runner group, or provision an eligible ephemeral/public runner matching those labels. Preserve the public trust-boundary label.

Acceptance criteria

• CloudCurator can see at least one online runner matching self-hosted, public, macOS, ARM64, and xcode.
• A rerun of CloudCurator PR feat: add synology deployment status surface #33 starts on a named runner and reports its runner group.
• PR feat: add synology deployment status surface #33's CI Gate completes through scripts/ci/run-ci.sh.
• The runner is isolated/ephemeral for public pull-request code and has no private persistent credentials.

Next actor

Runner-fleet or organization administrator: grant the repository access to the isolated public macOS/Xcode group (or provision that pool), then rerun PR #33.

[jmcte]

Fresh verification confirms the blocker is outside the CloudCurator repository:

• GET /repos/OMT-Global/cloudcurator/actions/runners returns total_count: 0.
• The current credential receives HTTP 403 from GET /orgs/OMT-Global/actions/runner-groups: it needs organization runner-group administration (admin:org or fine-grained runner-group permission).
• Because the repository is private on its current GitHub plan, branch protection/ruleset enforcement is unavailable. PR Publish a shell-safe workflow cookbook and compatibility matrix #28 therefore merged while its queued check was not enforced; do not use that bypass for the remaining high-risk PRs.

Required next action remains an organization runner administrator granting CloudCurator access to an online private macOS ARM64/Xcode group, then rerunning PR #32. A non-author reviewer must approve before the remaining PRs are merged.

[jmcte]

2026-07-13 execution status

Current automation credentials cannot perform the required organization runner-group operation. Live verification returned HTTP 403 for GET /orgs/OMT-Global/actions/runner-groups and GitHub reports that admin:org or fine-grained runner-group permission is required.

This remains an administrator-owned rollout, not a repository code defect. Required completion evidence remains:

1. grant CloudCurator access to an isolated public macOS/ARM64/Xcode group or provision that eligible ephemeral pool;
2. verify a named runner and runner group appear on CloudCurator PR feat: add synology deployment status surface #33;
3. rerun PR feat: add synology deployment status surface #33 through scripts/ci/run-ci.sh and confirm CI Gate;
4. record that the runner contains no private persistent credentials.

Do not route this public PR to the existing private persistent macOS pool.