Run "softwareupdate" on vanilla images (#204)

* Run "softwareupdate" on vanilla images

* Install Command Line Tools for Xcode

* Run Ansible after password-less sudo is configured

* Don't use SFTP

* Fix Ansible playbook path

* No updates are available → No new software available

* stderr_lines → stderr

* Dynamically resolve MACOS_NUMBER

ansible/playbook-system-updater.yml

@@ -0,0 +1,5 @@
+- hosts: default
+  roles:
+    - system-updater
+  vars:
+    ansible_password: admin

ansible/roles/system-updater/tasks/main.yml

@@ -0,0 +1,27 @@
+- name: Perform first "softwareupdate" invocation
+  include_tasks: softwareupdate.yml
+
+# Needed after a major macOS update, otherwise things like
+# Command Line Tools won't be updated
+- name: Perform second "softwareupdate" invocation
+  include_tasks: softwareupdate.yml
+
+# This one looks weird, but unfortunately there's no other way around, because Homebrew
+# is not designed to run as root (see https://gist.github.com/irazasyed/7732946
+# for more details).
+- name: fix up /usr/local permissions for Homebrew
+  file:
+    path: /usr/local/share/man
+    state: directory
+    owner: "{{ ansible_user_id }}"
+    recurse: yes
+  become: yes
+
+- name: Ensure that there are no more software updates available (1/2)
+  command: "softwareupdate --all --list"
+  register: check_updates_result
+
+- name: Ensure that there are no more software updates available (2/2)
+  assert:
+    that:
+      - "'No new software available' in check_updates_result.stderr"

ansible/roles/system-updater/tasks/softwareupdate.yml

@@ -0,0 +1,26 @@
+# It seems that we must always pass "--restart" command-line argument to "softwareupdate",
+# otherwise on the OS update the "softwareupdate" will be stuck at "Downloaded: macOS [...]"
+- name: install all macOS updates
+  command:
+    cmd: "softwareupdate --all --install --agree-to-license --force --restart --user admin --stdinpass"
+    stdin: "{{ ansible_password }}"
+  register: update_result
+  # Work around the following:
+  # > Data could not be sent to remote host [...].
+  # > Make sure this host can be reached over ssh:
+  # > ssh: connect to host [...] port 22: Connection refused.
+  ignore_unreachable: yes
+  # Ignore SIGTERM/SIGKILL sent "softwareupdate" process
+  # when the system reboots due to --restart
+  failed_when: update_result.rc not in [0, 9, -9, 15, -15]
+  become: yes
+
+# Wait for the connection since the previous command could restart the host
+- name: wait for connection
+  wait_for_connection:
+    # We need to wait long enough for the "softwareupdate" to initiate the reboot,
+    # otherwise it's possible that we'll interrupt the process by running
+    # the commands below on a non-restarted system.
+    delay: 60
+    timeout: 1800
+  when: "'No updates are available' not in (update_result.stderr_lines | join('\n'))"