From 98538f39f6469db63d3856dec24bdcd81d7bc012 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Rodrigo=20Gon=C3=A7alves=20da=20Silva?=
 <rodrigogoncalveess@gmail.com>
Date: Thu, 30 Jul 2026 23:11:00 -0700
Subject: [PATCH 1/2] Allow upstream SimpleGraphic Windows validation

---
 .github/workflows/macos-release.yml | 14 ++++++++++++--
 macos/README.md                     | 10 ++++++----
 2 files changed, 18 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/macos-release.yml b/.github/workflows/macos-release.yml
index 18eb9ea7119..817462dfa2e 100644
--- a/.github/workflows/macos-release.yml
+++ b/.github/workflows/macos-release.yml
@@ -33,6 +33,11 @@ on:
         description: Successful Windows CI run ID for the SimpleGraphic commit
         required: true
         type: string
+      simplegraphic_windows_repository:
+        description: Repository that ran the SimpleGraphic Windows workflow
+        required: true
+        default: PathOfBuildingCommunity/PathOfBuilding-SimpleGraphic
+        type: string
 
 permissions:
   contents: read
@@ -79,6 +84,7 @@ jobs:
       SIMPLEGRAPHIC_COMMIT: ${{ inputs.simplegraphic_commit }}
       SIMPLEGRAPHIC_SHA256: ${{ inputs.simplegraphic_sha256 }}
       SIMPLEGRAPHIC_WINDOWS_RUN_ID: ${{ inputs.simplegraphic_windows_run_id }}
+      SIMPLEGRAPHIC_WINDOWS_REPOSITORY: ${{ inputs.simplegraphic_windows_repository }}
     steps:
       - name: Checkout candidate
         uses: actions/checkout@v4
@@ -109,6 +115,10 @@ jobs:
             printf 'simplegraphic_windows_run_id must be a positive integer\n' >&2
             exit 2
           fi
+          if ! printf '%s\n' "$SIMPLEGRAPHIC_WINDOWS_REPOSITORY" | grep -Eq '^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$'; then
+            printf 'simplegraphic_windows_repository must use owner/repository\n' >&2
+            exit 2
+          fi
 
           rc_version="$RELEASE_VERSION-rc.$RC_NUMBER"
           tag_name="macos-v$rc_version"
@@ -138,7 +148,7 @@ jobs:
             printf 'SimpleGraphic tag resolves to %s, expected %s\n' "$runtime_tag_commit" "$SIMPLEGRAPHIC_COMMIT" >&2
             exit 1
           fi
-          windows_run=$(gh api "repos/$runtime_repo/actions/runs/$SIMPLEGRAPHIC_WINDOWS_RUN_ID")
+          windows_run=$(gh api "repos/$SIMPLEGRAPHIC_WINDOWS_REPOSITORY/actions/runs/$SIMPLEGRAPHIC_WINDOWS_RUN_ID")
           windows_run_commit=$(printf '%s' "$windows_run" | jq -r '.head_sha')
           windows_run_result=$(printf '%s' "$windows_run" | jq -r '.status + "/" + (.conclusion // "")')
           windows_run_path=$(printf '%s' "$windows_run" | jq -r '.path')
@@ -184,7 +194,7 @@ jobs:
           archive="PathOfBuilding-macOS-arm64-v$RC_VERSION.zip"
           checksum=$(cut -d ' ' -f 1 "build-macos/release/$archive.sha256")
           runner_version=$(sw_vers -productVersion)
-          windows_run_url="$GITHUB_SERVER_URL/$GITHUB_REPOSITORY_OWNER/PathOfBuilding-SimpleGraphic/actions/runs/$SIMPLEGRAPHIC_WINDOWS_RUN_ID"
+          windows_run_url="$GITHUB_SERVER_URL/$SIMPLEGRAPHIC_WINDOWS_REPOSITORY/actions/runs/$SIMPLEGRAPHIC_WINDOWS_RUN_ID"
           {
             printf '%s\n' '# Experimental macOS release candidate'
             printf '\n%s\n' '**Unsigned, experimental, and published from the `rodgons/PathOfBuilding` fork. This is not an official upstream Path of Building release.**'
diff --git a/macos/README.md b/macos/README.md
index 72dbbe4d2a6..8fd3254e315 100644
--- a/macos/README.md
+++ b/macos/README.md
@@ -77,13 +77,15 @@ gh workflow run macos-release.yml \
   -f simplegraphic_tag=issue-9-smoke-20260730 \
   -f simplegraphic_commit=98e98efcc747fea5ee96dd933de51685887db417 \
   -f simplegraphic_sha256=4eb99b5d371243ea11ab02de891d6e9624f809d64e8dfc6a3cd760fc9b6a06c2 \
-  -f simplegraphic_windows_run_id=WINDOWS_RUN_ID
+  -f simplegraphic_windows_run_id=WINDOWS_RUN_ID \
+  -f simplegraphic_windows_repository=PathOfBuildingCommunity/PathOfBuilding-SimpleGraphic
 ```
 
 The Windows run ID must identify a successful SimpleGraphic `Build DLL` workflow
-run for the exact runtime commit. The workflow verifies that run, the lightweight
-runtime tag and digest, the source manifest version, the runtime acceptance
-smoke, the Lua suite, and ModCache before packaging. It then
+run for the exact runtime commit. The Windows workflow may run in a different
+repository from the fork-published runtime artifact. The workflow verifies that
+run, the lightweight runtime tag and digest, the source manifest version, the
+runtime acceptance smoke, the Lua suite, and ModCache before packaging. It then
 publishes `macos-v2.66.2-rc.1` as an experimental prerelease with the zipped
 app, SHA-256 file, automated validation logs, source/runtime provenance,
 Gatekeeper instructions, and known limitations. The same evidence is retained

From a023fb140d55d650a0fcbe7d7c3e73c8083ceece Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Rodrigo=20Gon=C3=A7alves=20da=20Silva?=
 <rodrigogoncalveess@gmail.com>
Date: Thu, 30 Jul 2026 23:11:45 -0700
Subject: [PATCH 2/2] Ignore macOS Finder metadata

---
 .gitignore | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.gitignore b/.gitignore
index e2800b9d559..611af80e456 100644
--- a/.gitignore
+++ b/.gitignore
@@ -7,6 +7,7 @@ inspect.lua
 
 # Development files
 *.lnk
+.DS_Store
 
 # Application files
 Builds/