NO-ISSUE: Add Darwin keychain failure diagnostics

[jhernand]

Summary

• capture CombinedOutput() from security default-keychain after the availability probe fails
• capture CombinedOutput() from security unlock-keychain against the test keychain
• include both command errors and outputs in the test failure

Purpose

This is a diagnostic-only PR intended to reveal which macOS security command is failing on the current macos-latest runner. It is not intended to merge.

The branch is based directly on the current upstream main and does not contain the changes from PR #1143.

Related failure: https://github.com/osac-project/osac/actions/runs/35971300958/job/107541477454?pr=1143

Validation

• go test ./internal/config/...
• Darwin/ARM64 cross-compile: GOOS=darwin GOARCH=arm64 CGO_ENABLED=0 go test -c -o /tmp/osac-config-darwin.test ./internal/config
• changed-file pre-commit checks

[openshift-ci-robot]

@jhernand: This pull request explicitly references no jira issue.

Details

In response to this:

Summary

• capture CombinedOutput() from security default-keychain after the availability probe fails
• capture CombinedOutput() from security unlock-keychain against the test keychain
• include both command errors and outputs in the test failure

Purpose

This is a diagnostic-only PR intended to reveal which macOS security command is failing on the current macos-latest runner. It is not intended to merge.

The branch is based directly on the current upstream main and does not contain the changes from PR #1143.

Related failure: https://github.com/osac-project/osac/actions/runs/35971300958/job/107541477454?pr=1143

Validation

• go test ./internal/config/...
• Darwin/ARM64 cross-compile: GOOS=darwin GOARCH=arm64 CGO_ENABLED=0 go test -c -o /tmp/osac-config-darwin.test ./internal/config
• changed-file pre-commit checks

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: jhernand

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• fulfillment-service/OWNERS [jhernand]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

_{Comment @coderabbitai help to get the list of available commands.}

[osac-ai]

ℹ️ E2E CaaS Full Install -- Skipped

This suite never reached the point of actually running -- see the run for why (e.g. the e2e-readiness gate wasn't met, or this suite wasn't needed for what changed).

ℹ️ E2E VMaaS Full Install -- Skipped

This suite never reached the point of actually running -- see the run for why (e.g. the e2e-readiness gate wasn't met, or this suite wasn't needed for what changed).

ℹ️ E2E BMaaS Full Install -- Skipped

This suite never reached the point of actually running -- see the run for why (e.g. the e2e-readiness gate wasn't met, or this suite wasn't needed for what changed).

[github-actions]

🧭 Jobs Selection (informational only)

E2E Suites

Suite	Decision	Source	Reason
VMAAS	sanity	gemini-inconclusive	AI judgment was inconclusive for this suite
CAAS	sanity	gemini-inconclusive	AI judgment was inconclusive for this suite
BMAAS	sanity	gemini-inconclusive	AI judgment was inconclusive for this suite

AI judgment confidence: 100%.
_{Estimated cost: $0.0063 (1933 input + 199 output tokens, gemini-3.1-pro-preview)}

Unit Tests

Job	Decision	Reason
fulfillment-service	run	This workflow has no per-component scoping -- runs for any non-doc change
osac-metering	run	This workflow has no per-component scoping -- runs for any non-doc change
osac-metering/adapters	run	This workflow has no per-component scoping -- runs for any non-doc change
osac-metering/schema	run	This workflow has no per-component scoping -- runs for any non-doc change

Integration Tests

Job	Decision	Reason
fulfillment-service	run	This workflow has no per-component scoping -- runs for any non-doc change
osac-operator	run	This workflow has no per-component scoping -- runs for any non-doc change
bare-metal-fulfillment-operator	run	This workflow has no per-component scoping -- runs for any non-doc change
osac-aap	run	This workflow has no per-component scoping -- runs for any non-doc change
osac-installer	run	This workflow has no per-component scoping -- runs for any non-doc change

Helm Lint

Job	Decision	Reason
osac-operator	skip	No changed files matched this job's path filter
bare-metal-fulfillment-operator	skip	No changed files matched this job's path filter
fulfillment-service	skip	No changed files matched this job's path filter
osac-aap	skip	No changed files matched this job's path filter
osac-csi-driver	skip	No changed files matched this job's path filter
osac-metering	skip	No changed files matched this job's path filter
osac-installer	skip	No dependent component chart changed

Checks & Builds

Job	Decision	Reason
Check generated code (proto)	skip	No changed files matched this job's path filter
fulfillment-service checks	run	Matches this job's path filter
Build container image (osac-operator)	skip	No changed files matched this job's path filter
Build container image (bare-metal-fulfillment-operator)	skip	No changed files matched this job's path filter
ansible-lint (osac-aap)	skip	No changed files matched this job's path filter
Darwin keychain tests	run	Matches this job's path filter

Every table above is informational only -- nothing here gates whether a job actually runs. The E2E Suites table can use AI judgment for ambiguous files; every other table is deterministic-only (no AI).