Run the macOS binaries job on macos-latest-xlarge

.github/workflows/release.yaml

@@ -32,6 +32,11 @@ on:
         type: string
         default: "homebrew-baton"
         description: "ConductorOne Homebrew tap repository name."
+      macos_runner:
+        required: false
+        type: string
+        default: "macos-latest-xlarge"
+        description: "Runner label for the macOS binaries job. Prefer an Apple Silicon label; the Intel macos-latest-large label is allowed for runner benchmarking, but it changes the Homebrew prefix and the codesigning host."
       go_source_hygiene:
         required: false
         type: boolean
@@ -185,6 +190,25 @@ jobs:
             exit 1
           fi
 
+      - name: Validate macOS runner label
+        env:
+          MACOS_RUNNER: ${{ inputs.macos_runner }}
+        run: |
+          # This job holds the Apple signing certificate and assumes the artifacts AWS role,
+          # so the runner it lands on is a trust decision, not a preference. Allow only
+          # GitHub-hosted labels. macos-latest-large is Intel, kept on the list so the
+          # larger runner tiers can be benchmarked against each other; it changes the
+          # Homebrew prefix and the codesigning host, so it is not a release default.
+          case "$MACOS_RUNNER" in
+            macos-latest|macos-latest-xlarge|macos-14-xlarge|macos-15-xlarge|macos-26-xlarge|macos-latest-large)
+              echo "Using macOS runner: $MACOS_RUNNER"
+              ;;
+            *)
+              echo "::error::macos_runner must be a GitHub-hosted macOS runner label from the allowlist, got: $MACOS_RUNNER"
+              exit 1
+              ;;
+          esac
+
       - name: Validate GORELEASER_PRO_KEY when msi enabled
         if: inputs.msi == true
         env:
@@ -303,7 +327,9 @@ jobs:
 
   goreleaser-binaries:
     needs: [determine-workflows-ref, release-preflight]
-    runs-on: macos-latest
+    # macos-latest has 3 vCPUs and GoReleaser builds one target per core, so the fourth
+    # target queues behind the first three. See the PR description for the measurements.
+    runs-on: ${{ inputs.macos_runner }}
     permissions:
       contents: read
       id-token: write # <-- needed for cosign keyless (OIDC)
@@ -313,6 +339,18 @@ jobs:
       binaries_checksums: ${{ steps.output-checksums.outputs.checksums }}
       released_at: ${{ steps.release-meta.outputs.released_at }}
     steps:
+      # Diagnostic: GoReleaser sizes its build semaphore from runtime.GOMAXPROCS(0),
+      # so the runner's core count decides how many of the four targets build at once.
+      # GitHub bills the standard macOS tier as "3-core or 4-core" and one observed
+      # release did get 4 slots, so record the hardware instead of inferring it.
+      - name: Report runner hardware
+        shell: bash
+        run: |
+          echo "runner_label=${{ inputs.macos_runner }}"
+          echo "ncpu=$(sysctl -n hw.ncpu) logical=$(sysctl -n hw.logicalcpu) physical=$(sysctl -n hw.physicalcpu)"
+          echo "cpu=$(sysctl -n machdep.cpu.brand_string 2>/dev/null || echo unknown)"
+          echo "mem_bytes=$(sysctl -n hw.memsize)"
+
       - name: Checkout caller repo
         uses: actions/checkout@v5
         with:

README.md

@@ -88,6 +88,7 @@ The release workflow accepts the following input parameters:
 | `msi` | No | `true` | Whether to build MSI Windows installers |
 | `msi_wxs_path` | No | `""` | Path to custom WXS template for MSI installer (uses default if not set) |
 | `brew` | No | `true` | Whether to publish a Homebrew formula to the selected public `conductorone` tap |
+| `macos_runner` | No | `macos-latest-xlarge` | Runner label for the macOS binaries job. Restricted to GitHub-hosted Apple Silicon labels (`macos-latest`, `macos-latest-xlarge`, `macos-14/15/26-xlarge`). |
 
 2. Ensure your repository has the following secrets configured: