ci: Mac CI with self-hosted runner for machine tests

.github/workflows/mac.yml

@@ -0,0 +1,132 @@
+name: Mac
+
+on:
+  workflow_dispatch:
+  pull_request:
+    paths:
+      - '.github/workflows/mac.yml'
+      - 'Makefile'
+      - 'contrib/gha/mac/**'
+      - 'vendor/**'
+      - 'test/tools/**'
+      - 'test/registries*.conf'
+      - 'hack/**'
+      - 'version/rawversion/*'
+      - 'cmd/podman/machine/**'
+      - 'pkg/machine/**'
+      - '**/*machine*.go'
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  build:
+    name: build (darwin arm64)
+    runs-on: macos-15
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        with:
+          persist-credentials: false
+
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c  # v6.4.0
+        with:
+          go-version-file: go.mod
+          cache: true
+
+      - name: Cache golangci-lint
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae  # v5.0.5
+        with:
+          path: ~/Library/Caches/golangci-lint
+          key: ${{ runner.os }}-golangci-${{ hashFiles('**/go.sum', '**/.golangci.yml') }}
+          restore-keys: |
+            ${{ runner.os }}-golangci-
+
+      - name: Lint
+        run: make golangci-lint
+
+      - name: Build core binaries
+        run: |
+          make .install.ginkgo
+          make podman-remote
+          make podman-mac-helper
+
+      - name: Upload test binaries
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
+        with:
+          name: podman-bin
+          # Single path keeps the `bin/` prefix; a path list would trigger LCA
+          # stripping and lose it, breaking chmod in the machine job.
+          path: bin
+          if-no-files-found: error
+
+      - name: Build .pkg installer
+        run: |
+          pushd contrib/pkginstaller
+          make ARCH=aarch64 NO_CODESIGN=1 pkginstaller
+          popd
+
+      - name: Build release zip
+        run: make podman-remote-release-darwin_arm64.zip
+
+      - name: Upload release artifacts
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
+        with:
+          name: podman-darwin-arm64
+          path: |
+            podman-remote-release-darwin_arm64.zip
+            contrib/pkginstaller/out/podman-installer-macos-*.pkg
+          if-no-files-found: error
+
+  machine:
+    name: machine (${{ matrix.provider }})
+    needs: build
+    runs-on:
+      group: mac-pool
+    timeout-minutes: 60
+    strategy:
+      fail-fast: false
+      max-parallel: 1
+      matrix:
+        provider: [applehv, libkrun]
+    env:
+      PROVIDER: ${{ matrix.provider }}
+      CONTAINERS_MACHINE_PROVIDER: ${{ matrix.provider }}
+      # machine_test.go rejects TMPDIR >= 22 chars on darwin (socket path budget).
+      TMPDIR: /private/tmp
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        with:
+          persist-credentials: false
+
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c  # v6.4.0
+        with:
+          go-version-file: go.mod
+          cache: true
+
+      - name: Pre-clean machine state
+        run: ./contrib/gha/mac/clean_state.sh
+
+      - name: Download test binaries
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
+        with:
+          name: podman-bin
+          # `path: bin` on upload sent the *contents* of bin/ (no prefix).
+          # Extract into bin/ to restore the layout.
+          path: bin
+
+      - name: Restore executable bits
+        run: chmod +x bin/ginkgo bin/darwin/podman bin/darwin/podman-mac-helper
+
+      - name: Run machine e2e
+        run: make localmachine
+
+      - name: Post-run cleanup
+        if: always()
+        run: ./contrib/gha/mac/clean_state.sh

contrib/gha/mac/clean_state.sh

@@ -0,0 +1,15 @@
+#!/usr/bin/env bash
+# Best-effort cleanup of podman machine state and leaked test processes.
+
+set +e
+
+pkill -f vfkit   2>/dev/null || true
+pkill -f krunkit 2>/dev/null || true
+pkill -f gvproxy 2>/dev/null || true
+pkill -f ginkgo  2>/dev/null || true
+
+rm -rf "$HOME/.local/share/containers/podman/machine" 2>/dev/null || true
+rm -rf "$HOME/.config/containers/podman"               2>/dev/null || true
+rm -rf "${TMPDIR:-/private/tmp}/podman"                2>/dev/null || true
+
+true