CI: macOS lane doesn't trigger on .minimal/minimal.toml, so guest-kernel bumps merge without a VM boot #897

Summary

ci-macos.yml's path filter does not include .minimal/minimal.toml, so a change to the upstream pin — which selects the guest kernel, rootfs and libkrun — does not trigger the macOS VM lane. ci-linux-kvm.yml already lists it (line 71); macOS does not.

The macOS lane consumes that file. Its own comment says so: "guest kernel + rootfs against the repo's own .minimal/minimal.toml" (ci-macos.yml:75). It just isn't triggered by it.

Why it matters

This is the exact hole that let gominimal/minimal#869 reach users. The guest kernel moved 6.12.43 -> 6.12.94 (gominimal/pkgs#311) crossing a release that turned a silent condition into a fatal connection reset, and nothing booted a macOS VM to notice. HVF is the platform where the guest kernel and libkrun interact, so it is the wrong lane to skip.

gominimal/minimal#881 — a kernel-moving pin bump — did run the macOS e2e, but only because it incidentally also edited crates/minvmd/README.md, which matches crates/minvmd/**. A pure pin bump would have merged with no macOS VM boot at all.

Fix

Add .minimal/minimal.toml to the macos filter in ci-macos.yml, matching the KVM lane.

Note

.github/workflows/ is CODEOWNER-gated, so this needs a human with that access; it cannot be sent as an ordinary PR.