macos-tahoe-xcode has not received any push since the GitHub Actions migration (403 permission_denied: write_package)

[BogdanAntonyuk]

ghcr.io/cirruslabs/macos-tahoe-xcode is missing 26.6, 27-beta and 27-beta-2,
even though releases exist for all three. :latest still resolves to 26.5
(sha256:61f6e857a3d65dd2f8daf9c51c7b837fa458bcc9181ae8556e645b534dab6bf6,
uploaded 2026-05-26T04:25:04Z), which predates #351.

The images build fine — only the push is rejected.
For 26.6 (run 28726848236, attempt 1),
the tahoe build finished in 20m34s and produced the artifact tahoe-xcode:26.6, then:

    pushing tahoe-xcode:26.6 to ghcr.io/cirruslabs/macos-tahoe-xcode{:26.6,:latest}...
    pushing config...
    Error: UnexpectedHTTPStatusCode(when: "pushing blob (POST)", code: 403,
      details: "{"errors":[{"code":"DENIED","message":"permission_denied: write_package"}]}")

Identical failure for 27-beta in run 27173687974 (already reported in #358).

Why this looks package-scoped rather than workflow-scoped:
in that same 26.6 run,
with the same GITHUB_TOKEN, macos-sequoia-xcode:26.6 pushed successfully.
macos-runner:{tahoe,sequoia,sonoma} and macos-tahoe-base:latest (pushed 2026-06-06,
under Actions) also work. Only macos-tahoe-xcode returns 403. That suggests the
macos-tahoe-xcode package's Manage Actions access does not grant Write to the
macos-image-templates repository, whereas the other packages do — consistent with
the last successful push predating the switch from a PAT to GITHUB_TOKEN in #351.

Why it hasn't self-healed:

1. The retry of the 26.6 job (attempt 2) failed earlier
   than the push, so the 403 never resurfaced. The guest APFS container failed to grow to
   the requested 140 GB (APFS Container Resize error code is 49189 /
   Error: -69606: A problem occurred while resizing APFS Container structures), leaving the
   VM at 41 GB with 1.3 GB free, and unarchiving the Xcode xip hit No space left on device.
2. In the final release run (28746500883),
   both Release Xcode 26.6 (tahoe) and (sequoia) were cancelled while still queued —
   zero steps executed. Only Update Runner Image (tahoe) ran, and it succeeded, so the run
   looked partially healthy and the Xcode image was never rebuilt.

Requested fix

1. Grant the macos-image-templates repository Write role on the macos-tahoe-xcode
   package (Package settings → Manage Actions access), matching macos-sequoia-xcode.
2. Re-publish the affected tags. release.yml already exposes a workflow_dispatch
   input, so xcode_version: 26.6 (then 27-beta, 27-beta-2) should be enough without
   cutting new releases.

[Lakr233]

is there any update? 26.6 fixed a critical RCE on the screensharing

[kyletimbaker]

is there any update? 26.6 fixed a critical RCE on the screensharing

I am not sure how OpenAI plans to maintain this repo after acquiring cirruslabs. I noticed there are no public members of the cirruslabs organization listed on GH, so it's possible they don't have anyone assigned to issues raised here. Do you think it's worth asking over in the openai/tart repo? This particular repo appears to be updated after the transition, so its unclear what the longterm plan is.

[Lakr233]

That's also my question. I think it's the right time to take this repo over. If nothing happens in the next week I'll do my own.

[cedigang]

Same question here. Who's responsible for this repo now?