Change macOS version and deal with code-signing #1484

milindl · 2025-10-13T10:22:07Z

Summary

This PR migrates our Semaphore CI pipeline from macOS 13 to macOS 15 in response to the company-wide infrastructure update, and addresses code-signing compatibility issues that arose with the newer macOS version.

Changes Made:

Updated Semaphore machine type from s1-prod-macos-13-5-arm64 to s1-macos-15-arm64-8
Added conditional logic to handle stricter code-signing requirements on macOS 15
Modified test execution to use go run instead of pre-built binaries when code-signing is detected

Technical Challenge:

macOS 15 has stricter security measures that prevent unsigned binaries from executing
Our existing test pipeline was failing because test binaries weren't code-signed
Solution: Use go run to compile and execute code in one step, bypassing unsigned binary restrictions
Solution: Added conditional execution logic in both regular and integration test scripts:

if [[ $(command -v codesign) ]]; then
    # macOS 15: Use go run to avoid unsigned binary issues
    go run $GO_TAGS examples/library-version/library-version.go
else
    # macOS 13 and older: Continue using pre-built binaries
    library-version
fi

…15-arm64-8'

Copilot

Pull Request Overview

This PR updates the macOS CI environment and addresses code-signing issues on newer macOS versions. The changes ensure tests can run properly by conditionally using go run instead of executing unsigned binaries.

Updated macOS version from 13.5 to 15 for ARM64 builds
Added conditional logic to handle code-signing requirements on newer macOS
Modified test execution to use go run when code-signing is available

Reviewed Changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 4 comments.

File	Description
.semaphore/semaphore.yml	Updated macOS machine type from 13.5 to 15 for ARM64
.semaphore/semaphore_commands.sh	Added conditional code-signing logic for test execution
.semaphore/semaphore_integration_commands.sh	Added conditional code-signing logic for integration test execution

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

Copilot · 2025-10-13T10:23:05Z

.semaphore/semaphore_commands.sh

+
+# If we're on newer macOS, avoid running binaries that are not code-signed, rather, use go run. 
+# Running go-kafkacat with `go run` needs some `go get` commands, so just check existence instead.
+if [[ $(command -v codesign) ]]; then which go-kafkacat; go run $GO_TAGS examples/library-version/library-version.go; (go run $GO_TAGS examples/library-version/library-version.go | grep "$EXPECT_LINK_INFO") || (echo "Incorrect linkage, expected $EXPECT_LINK_INFO" ; false); else go-kafkacat --help; library-version; (library-version | grep "$EXPECT_LINK_INFO") || (echo "Incorrect linkage, expected $EXPECT_LINK_INFO" ; false); fi


This line is extremely long and difficult to read. Consider breaking it into multiple lines or using separate conditional blocks for better readability and maintainability.

Suggested change

if [[ $(command -v codesign) ]]; then which go-kafkacat; go run $GO_TAGS examples/library-version/library-version.go; (go run $GO_TAGS examples/library-version/library-version.go | grep "$EXPECT_LINK_INFO") || (echo "Incorrect linkage, expected $EXPECT_LINK_INFO" ; false); else go-kafkacat --help; library-version; (library-version | grep "$EXPECT_LINK_INFO") || (echo "Incorrect linkage, expected $EXPECT_LINK_INFO" ; false); fi

if [[ $(command -v codesign) ]]; then

which go-kafkacat

go run $GO_TAGS examples/library-version/library-version.go

(go run $GO_TAGS examples/library-version/library-version.go | grep "$EXPECT_LINK_INFO") || (echo "Incorrect linkage, expected $EXPECT_LINK_INFO" ; false)

else

go-kafkacat --help

library-version

(library-version | grep "$EXPECT_LINK_INFO") || (echo "Incorrect linkage, expected $EXPECT_LINK_INFO" ; false)

fi

Copilot · 2025-10-13T10:23:05Z

.semaphore/semaphore_integration_commands.sh

+
+# If we're on newer macOS, avoid running binaries that are not code-signed, rather, use go run. 
+# Running go-kafkacat with `go run` needs some `go get` commands, so just check existence instead.
+if [[ $(command -v codesign) ]]; then which go-kafkacat; go run $GO_TAGS examples/library-version/library-version.go; (go run $GO_TAGS examples/library-version/library-version.go | grep "$EXPECT_LINK_INFO") || (echo "Incorrect linkage, expected $EXPECT_LINK_INFO" ; false); else go-kafkacat --help; library-version; (library-version | grep "$EXPECT_LINK_INFO") || (echo "Incorrect linkage, expected $EXPECT_LINK_INFO" ; false); fi


This line is extremely long and difficult to read. Consider breaking it into multiple lines or using separate conditional blocks for better readability and maintainability.

Suggested change

if [[ $(command -v codesign) ]]; then which go-kafkacat; go run $GO_TAGS examples/library-version/library-version.go; (go run $GO_TAGS examples/library-version/library-version.go | grep "$EXPECT_LINK_INFO") || (echo "Incorrect linkage, expected $EXPECT_LINK_INFO" ; false); else go-kafkacat --help; library-version; (library-version | grep "$EXPECT_LINK_INFO") || (echo "Incorrect linkage, expected $EXPECT_LINK_INFO" ; false); fi

if [[ $(command -v codesign) ]]; then

which go-kafkacat

go run $GO_TAGS examples/library-version/library-version.go

if ! go run $GO_TAGS examples/library-version/library-version.go | grep "$EXPECT_LINK_INFO"; then

echo "Incorrect linkage, expected $EXPECT_LINK_INFO"

false

fi

else

go-kafkacat --help

library-version

if ! library-version | grep "$EXPECT_LINK_INFO"; then

echo "Incorrect linkage, expected $EXPECT_LINK_INFO"

false

fi

fi

Copilot · 2025-10-13T10:23:05Z

.semaphore/semaphore_commands.sh

+
+# If we're on newer macOS, avoid running binaries that are not code-signed, rather, use go run. 
+# Running go-kafkacat with `go run` needs some `go get` commands, so just check existence instead.
+if [[ $(command -v codesign) ]]; then which go-kafkacat; go run $GO_TAGS examples/library-version/library-version.go; (go run $GO_TAGS examples/library-version/library-version.go | grep "$EXPECT_LINK_INFO") || (echo "Incorrect linkage, expected $EXPECT_LINK_INFO" ; false); else go-kafkacat --help; library-version; (library-version | grep "$EXPECT_LINK_INFO") || (echo "Incorrect linkage, expected $EXPECT_LINK_INFO" ; false); fi


The command go run examples/library-version/library-version.go is executed twice in the same line, which is inefficient. Consider storing the output in a variable and reusing it.

Suggested change

if [[ $(command -v codesign) ]]; then which go-kafkacat; go run $GO_TAGS examples/library-version/library-version.go; (go run $GO_TAGS examples/library-version/library-version.go | grep "$EXPECT_LINK_INFO") || (echo "Incorrect linkage, expected $EXPECT_LINK_INFO" ; false); else go-kafkacat --help; library-version; (library-version | grep "$EXPECT_LINK_INFO") || (echo "Incorrect linkage, expected $EXPECT_LINK_INFO" ; false); fi

if [[ $(command -v codesign) ]]; then

which go-kafkacat

output="$(go run $GO_TAGS examples/library-version/library-version.go)"

echo "$output"

(echo "$output" | grep "$EXPECT_LINK_INFO") || (echo "Incorrect linkage, expected $EXPECT_LINK_INFO" ; false)

else

go-kafkacat --help

library-version

(library-version | grep "$EXPECT_LINK_INFO") || (echo "Incorrect linkage, expected $EXPECT_LINK_INFO" ; false)

fi

Copilot · 2025-10-13T10:23:06Z

.semaphore/semaphore_integration_commands.sh

+
+# If we're on newer macOS, avoid running binaries that are not code-signed, rather, use go run. 
+# Running go-kafkacat with `go run` needs some `go get` commands, so just check existence instead.
+if [[ $(command -v codesign) ]]; then which go-kafkacat; go run $GO_TAGS examples/library-version/library-version.go; (go run $GO_TAGS examples/library-version/library-version.go | grep "$EXPECT_LINK_INFO") || (echo "Incorrect linkage, expected $EXPECT_LINK_INFO" ; false); else go-kafkacat --help; library-version; (library-version | grep "$EXPECT_LINK_INFO") || (echo "Incorrect linkage, expected $EXPECT_LINK_INFO" ; false); fi


The command go run examples/library-version/library-version.go is executed twice in the same line, which is inefficient. Consider storing the output in a variable and reusing it.

Suggested change

if [[ $(command -v codesign) ]]; then which go-kafkacat; go run $GO_TAGS examples/library-version/library-version.go; (go run $GO_TAGS examples/library-version/library-version.go | grep "$EXPECT_LINK_INFO") || (echo "Incorrect linkage, expected $EXPECT_LINK_INFO" ; false); else go-kafkacat --help; library-version; (library-version | grep "$EXPECT_LINK_INFO") || (echo "Incorrect linkage, expected $EXPECT_LINK_INFO" ; false); fi

if [[ $(command -v codesign) ]]; then which go-kafkacat; output=$(go run $GO_TAGS examples/library-version/library-version.go); echo "$output"; (echo "$output" | grep "$EXPECT_LINK_INFO") || (echo "Incorrect linkage, expected $EXPECT_LINK_INFO" ; false); else go-kafkacat --help; library-version; (library-version | grep "$EXPECT_LINK_INFO") || (echo "Incorrect linkage, expected $EXPECT_LINK_INFO" ; false); fi

sonarqube-confluent · 2025-10-13T10:52:46Z

Analysis Details

0 Issues

0 Bugs
0 Vulnerabilities
0 Code Smells

Coverage and Duplications

No coverage information (55.70% Estimated after merge)
No duplication information (0.00% Estimated after merge)

Project ID: confluent-kafka-go

View in SonarQube

…rison

sonarqube-confluent · 2025-12-10T15:26:46Z

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
No data about Coverage
No data about Duplication

See analysis details on SonarQube

service-bot-app bot and others added 5 commits September 25, 2025 01:47

Replace all occurrences of 's1-prod-macos-13-5-arm64' with 's1-macos-…

3f6d1d5

…15-arm64-8'

Attempt to codesign binary for macos

bf50d27

Add different path for macOS

682d447

Move if-block to be 'one-liner'

18548e4

Add tags to dynamic build

db0b660

milindl requested review from a team as code owners October 13, 2025 10:22

Copilot AI review requested due to automatic review settings October 13, 2025 10:22

Copilot AI reviewed Oct 13, 2025

View reviewed changes

Merge remote-tracking branch 'origin/master' into dev_change_macos_ve…

9cfa3f1

…rison

airlock-confluentinc bot force-pushed the dev_change_macos_verison branch from 222059b to 9cfa3f1 Compare December 10, 2025 13:31

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Change macOS version and deal with code-signing #1484

Change macOS version and deal with code-signing #1484

Uh oh!

milindl commented Oct 13, 2025 •

edited by k-raina

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Oct 13, 2025

Uh oh!

Copilot AI Oct 13, 2025

Uh oh!

Copilot AI Oct 13, 2025

Uh oh!

Copilot AI Oct 13, 2025

Uh oh!

sonarqube-confluent bot commented Oct 13, 2025

Uh oh!

sonarqube-confluent bot commented Dec 10, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Change macOS version and deal with code-signing #1484

Are you sure you want to change the base?

Change macOS version and deal with code-signing #1484

Uh oh!

Conversation

milindl commented Oct 13, 2025 • edited by k-raina Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes Made:

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Copilot AI Oct 13, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 13, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 13, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 13, 2025

Choose a reason for hiding this comment

Uh oh!

sonarqube-confluent bot commented Oct 13, 2025

Analysis Details

0 Issues

Coverage and Duplications

Uh oh!

sonarqube-confluent bot commented Dec 10, 2025

Quality Gate passed

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

milindl commented Oct 13, 2025 •

edited by k-raina

Loading