ci(release): skip macOS verification

[tejaskash]

What

Moves the macOS verification into its own job in the reusable verify workflow, gated by a new macos input that defaults to true. The release workflow passes macos: false. CI keeps all three platforms.

Why

#2381 tried to drop macOS from release with a matrix exclude. GitHub rejects an exclude key that is not a matrix dimension, and exclude runs before include, so it can never remove an include entry. The workflow failed to materialize and #2385 reverted it. A separate job with an if is the only way to skip a platform by input.

How tested

• actionlint on verify.yml, release-main-and-preview.yml, ci.yml
• prettier check on both changed files
• CI on this PR runs verify.yml with the default input and must show Linux, Windows, and macOS jobs

[agentcore-devx-automation]

Claude Security Review: no high-confidence findings. (run)

[agentcore-devx-automation]

AgentCore Harness Review

Verdict: Looks good

The refactor is well-reasoned and the diff is small and self-contained.

• The matrix exclude-can't-drop-include limitation is real, and pulling macOS out into a separate job gated by an inputs.macos boolean is the standard way to make a platform conditionally skippable in a reusable workflow. The inline comment captures the constraint clearly.
• ci.yml doesn't pass macos, so PR/CI runs still cover Linux, Windows, and macOS via the default: true. release-main-and-preview.yml explicitly sets macos: false, matching the intent from #2381.
• needs: verify in the publish job correctly references the reusable-workflow caller job; a skipped verify-macos won't fail the parent, and a failure would still block publish.
• Workflow-level AGENTCORE_TELEMETRY_DISABLED, persist-credentials: false, and least-privilege contents: read are preserved in the new job. Codecov still only uploads from Linux.

Minor observation, not a blocker: the new macOS job runs bun test without --coverage, and duplicates the build/pack/compile/smoke-test steps from the matrix. That's a deliberate tradeoff of the "job per platform via if" approach and is fine as-is.

Nothing that needs to change before merging.

[jariy17]

looks good

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 97.25%. Comparing base (484fdde) to head (e2b0c64).
⚠️ Report is 1 commits behind head on refactor.

Additional details and impacted files

@@            Coverage Diff            @@
##           refactor    #2387   +/-   ##
=========================================
  Coverage     97.25%   97.25%           
=========================================
  Files           613      613           
  Lines         41028    41028           
=========================================
  Hits          39902    39902           
  Misses         1126     1126           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

Thanks for the report, @codecov-commenter — feedback like this is exactly
how we catch the things we missed. Because this PR is already
closed, the team won't see follow-up comments here.

Would you mind opening a new issue so we can track it properly?
https://github.com/aws/agentcore-cli/issues/new/choose

If this is a security issue, please report it privately via
https://aws.amazon.com/security/vulnerability-reporting/ instead
of a public issue.