Use macOS-safe runner workdir

services/forgejo-nsc/internal/nsc/macos.go

@@ -125,6 +125,16 @@ func macosComputeBaseImageID(baseImageID string) string {
 	}
 }
 
+func macosWorkDir(workdir string) string {
+	workdir = strings.TrimSpace(workdir)
+	switch workdir {
+	case "", "/var/lib/forgejo-runner":
+		return "/tmp/forgejo-runner"
+	default:
+		return workdir
+	}
+}
+
 type nscBearerTokenFile struct {
 	BearerToken string `json:"bearer_token"`
 }
@@ -183,10 +193,7 @@ func (d *Dispatcher) launchMacOSRunner(ctx context.Context, runnerName string, r
 	httpClient := &http.Client{Timeout: 60 * time.Second}
 	client := computev1betaconnect.NewComputeServiceClient(httpClient, d.opts.ComputeBaseURL)
 
-	workdir := d.opts.WorkDir
+	workdir := macosWorkDir(d.opts.WorkDir)
-	if strings.TrimSpace(workdir) == "" {
-		workdir = "/tmp/forgejo-runner"
-	}
 
 	env := map[string]string{
 		"FORGEJO_INSTANCE_URL":   req.InstanceURL,

services/forgejo-nsc/internal/nsc/macos_nsc.go

@@ -305,9 +305,7 @@ func (d *Dispatcher) destroyNSCInstance(ctx context.Context, runnerName, instanc
 }
 
 func macosBootstrapWrapperScript(runnerName string, req LaunchRequest, executor, workdir string) string {
-	if strings.TrimSpace(workdir) == "" {
+	workdir = macosWorkDir(workdir)
-		workdir = "/tmp/forgejo-runner"
-	}
 
 	// Pass all values via stdin script so secrets do not appear in the nsc ssh argv.
 	env := map[string]string{