Use writable macOS runner workdir

services/forgejo-nsc/internal/nsc/macos.go

@@ -151,6 +151,14 @@ func readNSCBearerToken() (string, error) {
 	return trimmed, nil
 }
 
+func macosRunnerWorkDir(configured string) string {
+	workdir := strings.TrimSpace(configured)
+	if workdir == "" || strings.HasPrefix(workdir, "/var/lib/") {
+		return "/tmp/forgejo-runner"
+	}
+	return workdir
+}
+
 func parseMachineTypeCPUxMemGB(machineType string) (vcpu int32, memoryMB int32, err error) {
 	parts := strings.Split(machineType, "x")
 	if len(parts) != 2 {
@@ -183,10 +191,7 @@ func (d *Dispatcher) launchMacOSRunner(ctx context.Context, runnerName string, r
 	httpClient := &http.Client{Timeout: 60 * time.Second}
 	client := computev1betaconnect.NewComputeServiceClient(httpClient, d.opts.ComputeBaseURL)
 
-	workdir := d.opts.WorkDir
-	if strings.TrimSpace(workdir) == "" {
-		workdir = "/tmp/forgejo-runner"
-	}
+	workdir := macosRunnerWorkDir(d.opts.WorkDir)
 
 	env := map[string]string{
 		"FORGEJO_INSTANCE_URL":   req.InstanceURL,

services/forgejo-nsc/internal/nsc/macos_nsc.go

@@ -296,9 +296,7 @@ func (d *Dispatcher) destroyNSCInstance(ctx context.Context, runnerName, instanc
 }
 
 func macosBootstrapWrapperScript(runnerName string, req LaunchRequest, executor, workdir string) string {
-	if strings.TrimSpace(workdir) == "" {
-		workdir = "/tmp/forgejo-runner"
-	}
+	workdir = macosRunnerWorkDir(workdir)
 
 	// Pass all values via stdin script so secrets do not appear in the nsc ssh argv.
 	env := map[string]string{

services/forgejo-nsc/internal/nsc/macos_test.go

@@ -0,0 +1,25 @@
+package nsc
+
+import "testing"
+
+func TestMacOSRunnerWorkDirUsesWritableEphemeralPath(t *testing.T) {
+	cases := []struct {
+		name       string
+		configured string
+		want       string
+	}{
+		{name: "empty", configured: "", want: "/tmp/forgejo-runner"},
+		{name: "linux var state", configured: "/var/lib/forgejo-runner", want: "/tmp/forgejo-runner"},
+		{name: "custom tmp", configured: "/tmp/custom-runner", want: "/tmp/custom-runner"},
+		{name: "home path", configured: "/Users/runner/forgejo-runner", want: "/Users/runner/forgejo-runner"},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			got := macosRunnerWorkDir(tc.configured)
+			if got != tc.want {
+				t.Fatalf("macosRunnerWorkDir(%q) = %q, want %q", tc.configured, got, tc.want)
+			}
+		})
+	}
+}