ci(macos): run real keychain tests against an unlocked temp keychain

Replaces the macOS sync/keychain ctest exclusion with a real unlocked keychain: create + unlock + set-default a temp keychain (same mechanism as the Codesign step) before ctest, mirroring a logged-in user's unlocked login keychain. This lets qtkeychain's Security.framework path store/read PATs headlessly, restoring macOS coverage of the sync/keychain code AND verifying the macOS keychain path actually works rather than skipping it.

Author: tamlok

.github/workflows/ci-macos.yml

@@ -156,17 +156,24 @@ jobs:
         # libs) then run them headlessly via the Qt offscreen platform plugin.
         # VNOTE_BUILD_TESTS defaults to ON, so no extra -D is needed.
         #
-        # The sync/keychain tests are EXCLUDED on macOS: their only
-        # macOS-specific code under test is third-party qtkeychain
-        # (keychain_apple.mm + Security.framework), which throws an uncaught
-        # NSInvalidArgumentException on a headless runner (no usable unlocked
-        # default keychain). The platform-agnostic sync LOGIC they cover is
-        # already exercised against the real backend on Linux + Windows, so
-        # macOS loses no unique signal. (Reclaiming this coverage via an
-        # in-memory credentials backend is a tracked follow-up.)
+        # Sync/keychain tests ARE run: we create + unlock a temporary default
+        # keychain (same mechanism as the Codesign step) so the real qtkeychain
+        # Security.framework path can store/read PATs, mirroring a logged-in
+        # user's unlocked login keychain. Without this, headless macOS has no
+        # usable default keychain and the SecItem* error path throws an uncaught
+        # NSInvalidArgumentException. This both restores coverage AND verifies
+        # the macOS keychain path actually works.
         run: |
           set -e
           cmake --build .
+          # Unlocked, no-timeout temp keychain as the default + only search entry.
+          KEYCHAIN="${{runner.workspace}}/vnote-test.keychain-db"
+          KC_PW="vnote-test-pw"
+          security create-keychain -p "$KC_PW" "$KEYCHAIN"
+          security set-keychain-settings -lut 21600 "$KEYCHAIN"
+          security unlock-keychain -p "$KC_PW" "$KEYCHAIN"
+          security list-keychains -d user -s "$KEYCHAIN"
+          security default-keychain -s "$KEYCHAIN"
           export QT_QPA_PLATFORM=offscreen
           # Force a UTF-8 locale so std::filesystem::path round-trips through
           # std::string preserve non-ASCII bytes. Without this, CJK filenames
@@ -178,7 +185,7 @@ jobs:
           # libVTextEdit.dylib lives next to the parent build's VNote binary;
           # add it to DYLD_LIBRARY_PATH so Qt-side test exes resolve it at load.
           export DYLD_LIBRARY_PATH="${{runner.workspace}}/build/libs/vtextedit/src:${DYLD_LIBRARY_PATH:-}"
-          ctest --output-on-failure -E '(sync|bootstrap|credential|keychain|syncinfo)'
+          ctest --output-on-failure
         working-directory: ${{runner.workspace}}/build
 
       - name: Re-run failed tests with extra-verbose output (debug aid)