Xcode 16.1

Seems it's leading to things like:

> Unable to connect to simulator.

.ci/cirrus.base.yml

@@ -0,0 +1,19 @@
+task:
+  name: "Update Base Images ($MACOS_VERSION)"
+  alias: update-base
+  matrix:
+    - env:
+        MACOS_VERSION: sonoma
+    - env:
+        MACOS_VERSION: sequoia
+  <<: *defaults
+  pull_vanilla_script:
+    - tart pull ghcr.io/cirruslabs/macos-$MACOS_VERSION-vanilla:latest
+  build_base_script:
+    - packer init templates/base.pkr.hcl
+    - packer build -var macos_version="$MACOS_VERSION" templates/base.pkr.hcl
+  push_base_script:
+    - tart push $MACOS_VERSION-base ghcr.io/cirruslabs/macos-$MACOS_VERSION-base:latest
+  always:
+    cleanup_script:
+      - tart delete $MACOS_VERSION-base

.ci/cirrus.release.yml

@@ -0,0 +1,23 @@
+task:
+  name: "Release Xcode $CIRRUS_TAG ($MACOS_VERSION)"
+  matrix:
+    - env:
+        MACOS_VERSION: sonoma
+    - env:
+        MACOS_VERSION: sequoia
+  <<: *defaults
+  pull_base_script:
+    - tart pull ghcr.io/cirruslabs/macos-$MACOS_VERSION-base:latest
+  build_script:
+    - packer init templates/xcode.pkr.hcl
+    - packer build -var macos_version="$MACOS_VERSION" -var xcode_version="[\"$CIRRUS_TAG\"]" templates/xcode.pkr.hcl
+  push_script: |
+    if [[ $CIRRUS_TAG == *"beta"* ]]
+    then
+      tart push $MACOS_VERSION-xcode:$CIRRUS_TAG ghcr.io/cirruslabs/macos-$MACOS_VERSION-xcode:$CIRRUS_TAG
+    else
+      tart push $MACOS_VERSION-xcode:$CIRRUS_TAG ghcr.io/cirruslabs/macos-$MACOS_VERSION-xcode:$CIRRUS_TAG ghcr.io/cirruslabs/macos-$MACOS_VERSION-xcode:latest
+    fi
+  always:
+    cleanup_script:
+      - tart delete $MACOS_VERSION-xcode:$CIRRUS_TAG || true

.ci/cirrus.runner.yml

@@ -0,0 +1,24 @@
+task:
+  name: "Update Runner Image ($MACOS_VERSION)"
+  env:
+    matrix:
+      - MACOS_VERSION: sonoma
+        XCODE_VERSIONS: 16,15.4,15.3,15.2
+      - MACOS_VERSION: sequoia
+        XCODE_VERSIONS: "16.1,\"16.2-beta-1\",16,15.4"
+  <<: *defaults
+  pull_base_script:
+    - tart pull ghcr.io/cirruslabs/macos-$MACOS_VERSION-base:latest
+  init_xcode_script: packer init templates/xcode.pkr.hcl
+  build_xcode_script: |
+      packer build -var tag=runner -var disk_size=300 \
+        -var disk_free_mb=100000 \
+        -var macos_version="$MACOS_VERSION" \
+        -var xcode_version="[$XCODE_VERSIONS]" \
+        -var additional_runtimes="[$ADDITIONAL_RUNTIMES]" \
+        templates/xcode.pkr.hcl
+  push_script: |
+    tart push "$MACOS_VERSION-xcode:runner" ghcr.io/cirruslabs/macos-runner:$MACOS_VERSION
+  always:
+    cleanup_script:
+      - tart delete "$MACOS_VERSION-xcode:runner"

.ci/cirrus.vanilla.yml

@@ -0,0 +1,29 @@
+task:
+  name: "Update Vanilla Sonoma Image"
+  only_if: $CIRRUS_BRANCH == $CIRRUS_DEFAULT_BRANCH && changesInclude("templates/vanilla-sonoma.pkr.hcl")
+  <<: *defaults
+  build_script:
+    - packer init templates/vanilla-sonoma.pkr.hcl
+    - packer build templates/vanilla-sonoma.pkr.hcl
+  disable_sip_script:
+    - packer build -var vm_name=sonoma-vanilla templates/disable-sip.pkr.hcl
+  push_script:
+    - tart push sonoma-vanilla ghcr.io/cirruslabs/macos-sonoma-vanilla:latest ghcr.io/cirruslabs/macos-sonoma-vanilla:14.6
+  always:
+    cleanup_script:
+      - tart delete sonoma-vanilla
+
+task:
+  name: "Update Vanilla Sequoia Image"
+  only_if: $CIRRUS_BRANCH == $CIRRUS_DEFAULT_BRANCH && changesInclude("templates/vanilla-sequoia.pkr.hcl")
+  <<: *defaults
+  build_script:
+    - packer init templates/vanilla-sequoia.pkr.hcl
+    - packer build templates/vanilla-sequoia.pkr.hcl
+  disable_sip_script:
+    - packer build -var vm_name=sequoia-vanilla templates/disable-sip.pkr.hcl
+  push_script:
+    - tart push sequoia-vanilla ghcr.io/cirruslabs/macos-sequoia-vanilla:latest ghcr.io/cirruslabs/macos-sequoia-vanilla:15.1
+  always:
+    cleanup_script:
+      - tart delete sequoia-vanilla

.ci/cirrus.xcode.yml

@@ -0,0 +1,35 @@
+task:
+  name: "Update Xcode Images ($MACOS_VERSION $XCODE_VERSION)"
+  depends_on: update-base
+  env:
+    matrix:
+      - MACOS_VERSION: sequoia
+        XCODE_VERSION: 16.1
+        LATEST: true
+      - MACOS_VERSION: sequoia
+        XCODE_VERSION: 16
+      - MACOS_VERSION: sonoma
+        XCODE_VERSION: 16
+        LATEST: true
+      - MACOS_VERSION: sonoma
+        XCODE_VERSION: 15.4
+      - MACOS_VERSION: sonoma
+        XCODE_VERSION: 15.3
+      - MACOS_VERSION: sonoma
+        XCODE_VERSION: 15.2
+  <<: *defaults
+  pull_base_script:
+    - tart pull ghcr.io/cirruslabs/macos-$MACOS_VERSION-base:latest
+  build_xcode_script:
+    - packer init templates/xcode.pkr.hcl
+    - packer build -var macos_version="$MACOS_VERSION" -var xcode_version="[\"$XCODE_VERSION\"]" templates/xcode.pkr.hcl
+  push_script: |
+    if [[ -z "$LATEST" ]]
+    then
+      tart push "$MACOS_VERSION-xcode:$XCODE_VERSION" ghcr.io/cirruslabs/macos-$MACOS_VERSION-xcode:$XCODE_VERSION
+    else
+      tart push "$MACOS_VERSION-xcode:$XCODE_VERSION" ghcr.io/cirruslabs/macos-$MACOS_VERSION-xcode:$XCODE_VERSION ghcr.io/cirruslabs/macos-$MACOS_VERSION-xcode:latest
+    fi
+  always:
+    cleanup_script:
+      - tart delete "$MACOS_VERSION-xcode:$XCODE_VERSION"

.cirrus.star

@@ -0,0 +1,47 @@
+load("cirrus", "env", "http", "fs")
+load("github.com/cirrus-modules/graphql", "rerun_task_if_issue_in_logs")
+
+
+def on_task_failed(ctx):
+  if ctx.payload.data.task.automaticReRun:
+    print("Task is already an automatic re-run! Won't even try to re-run it...")
+    return
+  rerun_task_if_issue_in_logs(ctx.payload.data.task.id, "The network connection was lost")
+
+
+def on_build_failed(ctx):
+  # Only send Slack notifications for failed cron builds[1]
+  #
+  # [1]: https://cirrus-ci.org/guide/writing-tasks/#cron-builds
+  if "Cron" not in ctx.payload.data.build.changeMessageTitle:
+    return
+
+  resp = http.post("https://slack.com/api/chat.postMessage", headers={
+    "Content-Type": "application/json",
+    "Authorization": "Bearer " + env.get("SLACK_TOKEN"),
+  }, json_body={
+    "channel": "#image-updates",
+    "text": "Build <https://cirrus-ci.com/build/{build_id}|{build_id} (\"{change_message_title}\")> failed on branch \"{branch_name}\" in repository \"{repository_name}\".".format(
+      build_id=ctx.payload.data.build.id, change_message_title=ctx.payload.data.build.changeMessageTitle,
+      branch_name=ctx.payload.data.build.branch, repository_name=ctx.payload.data.repository.name),
+  })
+
+  if resp.status_code != 200:
+    fail("failed to post message to Slack: got unexpected HTTP {}".format(resp.status_code))
+
+  resp_json = resp.json()
+
+  if resp_json["ok"] != True:
+    fail("got error when posting message to Slack: {}".format(resp_json["error"]))
+
+
+def main(ctx):
+  result = fs.read(".ci/cirrus.vanilla.yml")
+  if env.get("CIRRUS_TAG") != None:
+    result += fs.read(".ci/cirrus.release.yml")
+  if env.get("CIRRUS_CRON") == "monthly":
+    result += fs.read(".ci/cirrus.base.yml")
+    result += fs.read(".ci/cirrus.xcode.yml")
+  if env.get("CIRRUS_CRON") == "weekly":
+    result += fs.read(".ci/cirrus.runner.yml")
+  return result

.cirrus.yml

@@ -1,47 +1,21 @@
-task:
-  name: "Update Base Image"
-  only_if: $CIRRUS_CRON != ""
-  persistent_worker:
-    labels:
-      name: dev-mini
-  env:
-    TART_REGISTRY_USERNAME: fkorotkov # GitHub supports only PATs
-    TART_REGISTRY_PASSWORD: ENCRYPTED[!82ed873afdf627284305afef4958c85a8f73127b09978a9786ac521559630ea6c9a5ab6e7f8315abf9ead09b6eff6eae!]
-  update_script: brew update && brew upgrade
-  info_script:
-    - tart --version
-    - packer --version
-  build_script:
-    - packer init templates/base.pkr.hcl
-    - packer build -var-file="variables.pkrvars.hcl" templates/base.pkr.hcl
-  push_script:
-    - tart push ventura-base ghcr.io/cirruslabs/macos-ventura-base:latest
-  always:
-    cleanup_script:
-      - tart delete ventura-base
+persistent_worker:
+  labels:
+    name: dev-mini
+  resources:
+    tart-vms: 1
 
-task:
-  name: "Release Xcode $CIRRUS_TAG"
-  only_if: $CIRRUS_TAG != ""
-  persistent_worker:
-    labels:
-      name: dev-mini
-  env:
-    TART_REGISTRY_USERNAME: fkorotkov # GitHub supports only PATs
-    TART_REGISTRY_PASSWORD: ENCRYPTED[!82ed873afdf627284305afef4958c85a8f73127b09978a9786ac521559630ea6c9a5ab6e7f8315abf9ead09b6eff6eae!]
-  update_script: brew update && brew upgrade
+env:
+  TART_REGISTRY_HOSTNAME: ghcr.io
+  TART_REGISTRY_USERNAME: fkorotkov # GitHub supports only PATs
+  TART_REGISTRY_PASSWORD: ENCRYPTED[!82ed873afdf627284305afef4958c85a8f73127b09978a9786ac521559630ea6c9a5ab6e7f8315abf9ead09b6eff6eae!]
+  AWS_ACCESS_KEY_ID: ENCRYPTED[c187b670a17eead88c1698849376273991d09678efe37ae2f0c9738c27a2422741a71c501ef4b6a4df7bff3eca5213a9]
+  AWS_SECRET_ACCESS_KEY: ENCRYPTED[e456254a53b82e3167f2da23e24c389620cb3f7d47e4e5e7d993813bf9bb18c784d5cb8d88d19632073acc9e1f6096c9]
+
+defaults: &defaults
+  timeout_in: 3h
+  update_script:
+    - brew update || true
+    - brew upgrade || true
   info_script:
     - tart --version
     - packer --version
-  pull_base_script:
-    - tart pull ghcr.io/cirruslabs/macos-ventura-base:latest
-    - tart clone ghcr.io/cirruslabs/macos-ventura-base:latest ventura-base
-  build_script:
-    - packer init templates/xcode.pkr.hcl
-    - packer build -var-file="variables.pkrvars.hcl" -var xcode_version="$CIRRUS_TAG" templates/xcode.pkr.hcl
-  push_script:
-    - tart push ventura-xcode:$CIRRUS_TAG ghcr.io/cirruslabs/macos-ventura-xcode:$CIRRUS_TAG ghcr.io/cirruslabs/macos-ventura-xcode:latest
-  always:
-    cleanup_script:
-      - tart delete ventura-base || true
-      - tart delete ventura-xcode:$CIRRUS_TAG || true

DEVELOPMENT.md

@@ -0,0 +1,25 @@
+## Building Vanilla Image
+
+To build `macos-sonoma-vanilla`:
+
+```bash
+packer build templates/vanilla-sonoma.pkr.hcl
+```
+
+Optionally, SIP can be disabled for each image by running the following commands:
+
+```bash
+packer build -var vm_name=sonoma-vanilla templates/disable-sip.pkr.hcl
+```
+
+## Building Base Image
+
+```bash
+packer build -var macos_version=sonoma templates/base.pkr.hcl
+```
+
+## Building Xcode Image
+
+```bash
+packer build -var macos_version=sonoma -var xcode_version="[15.4]" templates/xcode.pkr.hcl
+```

README.md

@@ -1,45 +1,30 @@
-## macOS Packer Templates for Cirrus CI
+## macOS Packer Templates for Tart
 
-Repository with Packer templates to build [Tart VMs](https://github.com/cirruslabs/tart) to use with [Cirrus CI](https://cirrus-ci.org/guide/macOS/).
+Repository with Packer templates to build macOS [Tart](https://tart.run/) virtual machines to use with [Cirrus Runners](https://cirrus-runners.app/),
+[Cirrus CI](https://cirrus-ci.org/guide/macOS/) or [any other automation](https://tart.run/integrations/cirrus-cli/).
 
-* `macos-{monterey,ventura}-vanilla` image has nothing pre-installed
-* `macos-{monterey,ventura}-base` image has only `brew` pre-installed
-* `macos-{monterey,ventura}-xcode:N` image is based on `macos-{monterey,ventura}-base` image and has `Xcode N` with [`Flutter`](https://flutter.dev/) pre-installed
+The following image variants are currently available:
 
-See a full list of VMs available on Cirrus CI [here](https://github.com/orgs/cirruslabs/packages?tab=packages&q=macos-).
+* `macos-{sequoia,sonoma}-base` image has only `brew` pre-installed and the latest version of `macOS` available
+* `macos-{sequoia,sonoma}-xcode:N` image is based on `macos-{sequoia,sonoma}-base` image and has `Xcode N` with [`Flutter`](https://flutter.dev/) pre-installed
+* `macos-runner:sonoma` image is a variant of `xcode:N` with 3 latest versions of `Xcode` pre-installed and [`xcodes` tool](https://github.com/XcodesOrg/xcodes) to switch between them.
 
-## Building Vanilla Image
+See a full list of VMs available [here](https://github.com/orgs/cirruslabs/packages?tab=packages&q=macos-).
 
-To build `macos-monterey-vanilla`:
+## Release Cadence
 
-```bash
-packer build templates/vanilla-monterey.pkr.hcl
-```
+Once a new version of Xcode is released, we will initiate a GitHub release which will automatically build and push
+a new version of the `macos-{sequoia,sonoma}-xcode:N` image as well as `macos-runner:sonoma`. This generally happens within 24 hours
+of a release. Please watch this repository releases to get notified about new images.
 
-To build `macos-ventura-vanilla`:
+## Update Cadence
 
-```bash
-packer build templates/vanilla-ventura.pkr.hcl
-```
+Some of the images are regularly getting rebuild in order to update the pre-installed packages. The following images are updated
+monthly on the first Saturday of the month:
 
-Optionally, SIP can be disabled for each image by running the following commands:
+* `ghcr.io/cirruslabs/macos-{sequoia,sonoma}-base`
+* `ghcr.io/cirruslabs/macos-sonoma-xcode:{16-beta,latest,15.4,15.3,15.2}`
+* `ghcr.io/cirruslabs/macos-sequoia-xcode:{16-beta}`
 
-```bash
-packer build -var vm_name=monterey-vanilla templates/disable-sip.pkr.hcl
-```
-
-```bash
-packer build -var vm_name=ventura-vanilla templates/disable-sip.pkr.hcl
-```
-
-## Building Base Image
-
-```bash
-packer build -var-file="variables.pkrvars.hcl" templates/base.pkr.hcl
-```
-
-## Building Xcode Image
-
-```bash
-packer build -var-file="variables.pkrvars.hcl" templates/xcode.pkr.hcl
-```
+Note that `ghcr.io/cirruslabs/macos-runner:sonoma` is updated every Sunday and this image is [optimised for startup](https://cirrus-runners.app/blog/2024/04/11/optimizing-startup-time-of-cirrus-runners/)
+on Cirrus Runners and Cirrus CI services.

data/limit.maxfiles.plist

@@ -0,0 +1,21 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN"
+        "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+  <dict>
+    <key>Label</key>
+    <string>limit.maxfiles</string>
+    <key>ProgramArguments</key>
+    <array>
+      <string>launchctl</string>
+      <string>limit</string>
+      <string>maxfiles</string>
+      <string>65536</string>
+      <string>524288</string>
+    </array>
+    <key>RunAtLoad</key>
+    <true/>
+    <key>ServiceIPC</key>
+    <false/>
+  </dict>
+</plist>

scripts/automationmodetool.expect

@@ -0,0 +1,6 @@
+#!/usr/bin/expect -f
+
+spawn automationmodetool enable-automationmode-without-authentication
+expect "Enter the password for user 'admin':"
+send "admin\n"
+expect "Setting up machine to allow Automation Mode without requiring user authentication... succeeded."

scripts/install-actions-runner.sh

@@ -0,0 +1,20 @@
+#!/bin/bash
+
+# Set shell options to enable fail-fast behavior
+#
+# * -e: fail the script when an error occurs or command fails
+# * -u: fail the script when attempting to reference unset parameters
+# * -o pipefail: by default an exit status of a pipeline is that of its
+#                last command, this fails the pipe early if an error in
+#                any of its commands occurs
+#
+set -euo pipefail
+
+source ~/.zprofile
+brew install jq
+
+DOWNLOAD_URL=$(curl -sS 'https://api.github.com/repos/actions/runner/releases/latest' | jq --raw-output '.assets[] | select(.name | test("actions-runner-osx-arm64-[0-9.]+.tar.gz")) | .browser_download_url')
+
+rm -rf actions-runner && mkdir actions-runner && cd actions-runner
+
+wget -O - "${DOWNLOAD_URL}" | tar xz

templates/base.pkr.hcl

@@ -1,22 +1,18 @@
 packer {
   required_plugins {
     tart = {
-      version = ">= 0.5.4"
+      version = ">= 1.12.0"
       source  = "github.com/cirruslabs/tart"
     }
   }
 }
 
 variable "macos_version" {
-  type =  string
-}
-
-variable "gha_version" {
-  type =  string
+  type = string
 }
 
 source "tart-cli" "tart" {
-  vm_base_name = "ghcr.io/cirruslabs/macos-${var.macos_version}-vanilla:13.2.1"
+  vm_base_name = "ghcr.io/cirruslabs/macos-${var.macos_version}-vanilla:latest"
   vm_name      = "${var.macos_version}-base"
   cpu_count    = 4
   memory_gb    = 8
@@ -29,17 +25,19 @@ source "tart-cli" "tart" {
 build {
   sources = ["source.tart-cli.tart"]
 
-  provisioner "shell" {
-    inline = [
-      "echo 'Disabling spotlight...'",
-      "sudo mdutil -a -i off",
-    ]
+  provisioner "file" {
+    source      = "data/limit.maxfiles.plist"
+    destination = "~/limit.maxfiles.plist"
   }
 
-  # setup DNS
   provisioner "shell" {
     inline = [
-      "networksetup -setdnsservers Ethernet 8.8.8.8 8.8.4.4 1.1.1.1",
+      "echo 'Configuring maxfiles...'",
+      "sudo mv ~/limit.maxfiles.plist /Library/LaunchDaemons/limit.maxfiles.plist",
+      "sudo chown root:wheel /Library/LaunchDaemons/limit.maxfiles.plist",
+      "sudo chmod 0644 /Library/LaunchDaemons/limit.maxfiles.plist",
+      "echo 'Disabling spotlight...'",
+      "sudo mdutil -a -i off",
     ]
   }
 
@@ -51,15 +49,6 @@ build {
     ]
   }
 
-  provisioner "shell" {
-    inline = [
-      "cd $HOME",
-      "mkdir actions-runner && cd actions-runner",
-      "curl -O -L https://github.com/actions/runner/releases/download/v${var.gha_version}/actions-runner-osx-arm64-${var.gha_version}.tar.gz",
-      "tar xzf ./actions-runner-osx-arm64-${var.gha_version}.tar.gz",
-      "rm actions-runner-osx-arm64-${var.gha_version}.tar.gz",
-    ]
-  }
   provisioner "shell" {
     inline = [
       "/bin/bash -c \"$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)\"",
@@ -70,19 +59,50 @@ build {
       "source ~/.zprofile",
       "brew --version",
       "brew update",
-      "brew install wget cmake gcc git-lfs jq gh",
+      "brew install curl wget unzip zip ca-certificates cmake gcc git-lfs jq yq gh gitlab-runner",
+      "brew install --cask git-credential-manager",
       "git lfs install",
+      "sudo softwareupdate --install-rosetta --agree-to-license"
+    ]
+  }
+
+  // Install the GitHub Actions runner
+  provisioner "shell" {
+    script = "scripts/install-actions-runner.sh"
+  }
+
+  // Create a /Users/runner → /Users/admin symlink to support certain GitHub Actions
+  // like ruby/setup-ruby that hard-code the "/Users/runner/hostedtoolcache" path[1]
+  //
+  // [1]: https://github.com/ruby/setup-ruby/blob/6bd3d993c602f6b675728ebaecb2b569ff86e99b/common.js#L268
+  provisioner "shell" {
+    inline = [
+      "sudo ln -s /Users/admin /Users/runner"
+    ]
+  }
+
+  provisioner "shell" {
+    inline = [
+      "source ~/.zprofile",
+      "brew install libyaml", # https://github.com/rbenv/ruby-build/discussions/2118
+      "brew install rbenv",
+      "echo 'if which rbenv > /dev/null; then eval \"$(rbenv init -)\"; fi' >> ~/.zprofile",
+      "source ~/.zprofile",
+      "rbenv install 2.7.8", // latest 2.x.x before EOL
+      "rbenv install -l | grep -v - | tail -2 | xargs -L1 rbenv install",
+      "rbenv global $(rbenv install -l | grep -v - | tail -1)",
+      "gem install bundler",
     ]
   }
   provisioner "shell" {
     inline = [
       "source ~/.zprofile",
-      "brew install rbenv",
-      "echo 'if which rbenv > /dev/null; then eval \"$(rbenv init -)\"; fi' >> ~/.zprofile",
+      "brew install node@20",
+      "echo 'export PATH=\"/opt/homebrew/opt/node@20/bin:$PATH\"' >> ~/.zprofile",
       "source ~/.zprofile",
-      "rbenv install 3.0.5",
-      "rbenv global 3.0.5",
-      "gem install bundler",
+      "node --version",
+      "npm install --global yarn",
+      "yarn --version",
     ]
   }
   provisioner "shell" {
@@ -90,4 +110,23 @@ build {
       "sudo safaridriver --enable",
     ]
   }
+  provisioner "shell" {
+    inline = [
+      "source ~/.zprofile",
+      "brew install awscli"
+    ]
+  }
+
+  # Enable UI automation, see https://github.com/cirruslabs/macos-image-templates/issues/136
+  provisioner "shell" {
+    script = "scripts/automationmodetool.expect"
+  }
+
+  // some other health checks
+  provisioner "shell" {
+    inline = [
+      "source ~/.zprofile",
+      "test -d /Users/runner"
+    ]
+  }
 }

templates/disable-sip.pkr.hcl

@@ -1,7 +1,7 @@
 packer {
   required_plugins {
     tart = {
-      version = ">= 0.5.4"
+      version = ">= 1.12.0"
       source  = "github.com/cirruslabs/tart"
     }
   }
@@ -22,11 +22,8 @@ source "tart-cli" "tart" {
     # Skip over "Macintosh" and select "Options"
     # to boot into macOS Recovery
     "<wait60s><right><right><enter>",
-    # Select default language
-    "<wait10s><enter>",
     # Open Terminal
-    "<wait10s><leftCtrlOn><f2><leftCtrlOff>",
-    "<right><right><right><right><down><down><down><enter>",
+    "<wait10s><leftAltOn>T<leftAltOff>",
     # Disable SIP
     "<wait10s>csrutil disable<enter>",
     "<wait10s>y<enter>",

templates/vanilla-sequoia.pkr.hcl

@@ -0,0 +1,121 @@
+packer {
+  required_plugins {
+    tart = {
+      version = ">= 1.12.0"
+      source  = "github.com/cirruslabs/tart"
+    }
+  }
+}
+
+source "tart-cli" "tart" {
+  from_ipsw    = "https://updates.cdn-apple.com/2024FallFCS/fullrestores/072-12340/78D28AC4-CCFC-45D2-BD27-1E5D915E43F9/UniversalMac_15.1_24B83_Restore.ipsw"
+  vm_name      = "sequoia-vanilla"
+  cpu_count    = 4
+  memory_gb    = 8
+  disk_size_gb = 40
+  ssh_password = "admin"
+  ssh_username = "admin"
+  ssh_timeout  = "300s"
+  boot_command = [
+    # hello, hola, bonjour, etc.
+    "<wait60s><spacebar>",
+    # Language: most of the times we have a list of "English"[1], "English (UK)", etc. with
+    # "English" language already selected. If we type "english", it'll cause us to switch
+    # to the "English (UK)", which is not what we want. To solve this, we switch to some other
+    # language first, e.g. "Italiano" and then switch back to "English". We'll then jump to the
+    # first entry in a list of "english"-prefixed items, which will be "English".
+    #
+    # [1]: should be named "English (US)", but oh well 🤷
+    "<wait30s>italiano<esc>english<enter>",
+    # Select Your Country and Region
+    "<wait30s>united states<leftShiftOn><tab><leftShiftOff><spacebar>",
+    # Written and Spoken Languages
+    "<wait10s><leftShiftOn><tab><leftShiftOff><spacebar>",
+    # Accessibility
+    "<wait10s><leftShiftOn><tab><leftShiftOff><spacebar>",
+    # Data & Privacy
+    "<wait10s><leftShiftOn><tab><leftShiftOff><spacebar>",
+    # Migration Assistant
+    "<wait10s><tab><tab><tab><spacebar>",
+    # Sign In with Your Apple ID
+    "<wait10s><leftShiftOn><tab><leftShiftOff><leftShiftOn><tab><leftShiftOff><spacebar>",
+    # Are you sure you want to skip signing in with an Apple ID?
+    "<wait10s><tab><spacebar>",
+    # Terms and Conditions
+    "<wait10s><leftShiftOn><tab><leftShiftOff><spacebar>",
+    # I have read and agree to the macOS Software License Agreement
+    "<wait10s><tab><spacebar>",
+    # Create a Computer Account
+    "<wait10s>admin<tab><tab>admin<tab>admin<tab><tab><tab><spacebar>",
+    # Enable Location Services
+    "<wait120s><leftShiftOn><tab><leftShiftOff><spacebar>",
+    # Are you sure you don't want to use Location Services?
+    "<wait10s><tab><spacebar>",
+    # Select Your Time Zone
+    "<wait10s><tab>UTC<enter><leftShiftOn><tab><leftShiftOff><spacebar>",
+    # Analytics
+    "<wait10s><leftShiftOn><tab><leftShiftOff><spacebar>",
+    # Screen Time
+    "<wait10s><tab><spacebar>",
+    # Siri
+    "<wait10s><tab><spacebar><leftShiftOn><tab><leftShiftOff><spacebar>",
+    # Choose Your Look
+    "<wait10s><leftShiftOn><tab><leftShiftOff><spacebar>",
+    # Welcome to Mac
+    "<wait10s><spacebar>",
+    # Enable Keyboard navigation
+    # This is so that we can navigate the System Settings app using the keyboard
+    "<wait10s><leftAltOn><spacebar><leftAltOff>Terminal<enter>",
+    "<wait10s>defaults write NSGlobalDomain AppleKeyboardUIMode -int 3<enter>",
+    "<wait10s><leftAltOn>q<leftAltOff>",
+    # Now that the installation is done, open "System Settings"
+    "<wait10s><leftAltOn><spacebar><leftAltOff>System Settings<enter>",
+    # Navigate to "Sharing"
+    "<wait10s><leftAltOn>f<leftAltOff>sharing<enter>",
+    # Navigate to "Screen Sharing" and enable it
+    "<wait10s><tab><tab><tab><tab><tab><spacebar>",
+    # Navigate to "Remote Login" and enable it
+    "<wait10s><tab><tab><tab><tab><tab><tab><tab><tab><tab><tab><tab><tab><spacebar>",
+    # Quit System Settings
+    "<wait10s><leftAltOn>q<leftAltOff>",
+  ]
+
+  // A (hopefully) temporary workaround for Virtualization.Framework's
+  // installation process not fully finishing in a timely manner
+  create_grace_time = "30s"
+}
+
+build {
+  sources = ["source.tart-cli.tart"]
+
+  provisioner "shell" {
+    inline = [
+      // Enable passwordless sudo
+      "echo admin | sudo -S sh -c \"mkdir -p /etc/sudoers.d/; echo 'admin ALL=(ALL) NOPASSWD: ALL' | EDITOR=tee visudo /etc/sudoers.d/admin-nopasswd\"",
+      // Enable auto-login
+      //
+      // See https://github.com/xfreebird/kcpassword for details.
+      "echo '00000000: 1ced 3f4a bcbc ba2c caca 4e82' | sudo xxd -r - /etc/kcpassword",
+      "sudo defaults write /Library/Preferences/com.apple.loginwindow autoLoginUser admin",
+      // Disable screensaver at login screen
+      "sudo defaults write /Library/Preferences/com.apple.screensaver loginWindowIdleTime 0",
+      // Disable screensaver for admin user
+      "defaults -currentHost write com.apple.screensaver idleTime 0",
+      // Prevent the VM from sleeping
+      "sudo systemsetup -setsleep Off 2>/dev/null",
+      // Launch Safari to populate the defaults
+      "/Applications/Safari.app/Contents/MacOS/Safari &",
+      "SAFARI_PID=$!",
+      "disown",
+      "sleep 30",
+      "kill -9 $SAFARI_PID",
+      // Enable Safari's remote automation
+      "sudo safaridriver --enable",
+      // Disable screen lock
+      //
+      // Note that this only works if the user is logged-in,
+      // i.e. not on login screen.
+      "sysadminctl -screenLock off -password admin",
+    ]
+  }
+}

templates/vanilla-sonoma.pkr.hcl

@@ -1,17 +1,15 @@
 packer {
   required_plugins {
     tart = {
-      version = ">= 0.5.4"
+      version = ">= 1.12.0"
       source  = "github.com/cirruslabs/tart"
     }
   }
 }
 
 source "tart-cli" "tart" {
-  # You can find macOS IPSW URLs on various websites like https://ipsw.me/
-  # and https://www.theiphonewiki.com/wiki/Beta_Firmware/Mac/13.x
-  from_ipsw    = "https://updates.cdn-apple.com/2022FallFCS/fullrestores/012-40537/0EC7C669-13E9-49FB-BD64-9EECC1D174B2/UniversalMac_12.6_21G115_Restore.ipsw"
-  vm_name      = "monterey-vanilla"
+  from_ipsw    = "https://updates.cdn-apple.com/2024SummerFCS/fullrestores/052-69922/F5DA2B64-25EB-4370-9E89-FA5689859796/UniversalMac_14.6_23G80_Restore.ipsw"
+  vm_name      = "sonoma-vanilla"
   cpu_count    = 4
   memory_gb    = 8
   disk_size_gb = 40
@@ -21,8 +19,14 @@ source "tart-cli" "tart" {
   boot_command = [
     # hello, hola, bonjour, etc.
     "<wait60s><spacebar>",
-    # Language
-    "<wait30s><enter>",
+    # Language: most of the times we have a list of "English"[1], "English (UK)", etc. with
+    # "English" language already selected. If we type "english", it'll cause us to switch
+    # to the "English (UK)", which is not what we want. To solve this, we switch to some other
+    # language first, e.g. "Italiano" and then switch back to "English". We'll then jump to the
+    # first entry in a list of "english"-prefixed items, which will be "English".
+    #
+    # [1]: should be named "English (US)", but oh well 🤷
+    "<wait30s>italiano<esc>english<enter>",
     # Select Your Country and Region
     "<wait30s>united states<leftShiftOn><tab><leftShiftOff><spacebar>",
     # Written and Spoken Languages
@@ -44,13 +48,13 @@ source "tart-cli" "tart" {
     # Create a Computer Account
     "<wait10s>admin<tab><tab>admin<tab>admin<tab><tab><tab><spacebar>",
     # Enable Location Services
-    "<wait10s><leftShiftOn><tab><leftShiftOff><spacebar>",
+    "<wait30s><leftShiftOn><tab><leftShiftOff><spacebar>",
     # Are you sure you don't want to use Location Services?
     "<wait10s><tab><spacebar>",
     # Select Your Time Zone
     "<wait10s><tab>UTC<enter><leftShiftOn><tab><leftShiftOff><spacebar>",
     # Analytics
-    "<wait10s><tab><spacebar><leftShiftOn><tab><leftShiftOff><spacebar>",
+    "<wait10s><leftShiftOn><tab><leftShiftOff><spacebar>",
     # Screen Time
     "<wait10s><tab><spacebar>",
     # Siri
@@ -59,14 +63,14 @@ source "tart-cli" "tart" {
     "<wait10s><leftShiftOn><tab><leftShiftOff><spacebar>",
     # Enable Voice Over
     "<wait10s><leftAltOn><f5><leftAltOff><wait5s>v",
-    # Now that the installation is done, open "System Preferences"
-    "<wait10s><leftAltOn><spacebar><leftAltOff>System Preferences<enter>",
+    # Now that the installation is done, open "System Settings"
+    "<wait10s><leftAltOn><spacebar><leftAltOff>System Settings<enter>",
     # Navigate to "Sharing"
-    "<wait10s>sharing<enter>",
-    # Enable Screen Sharing
-    "<wait10s><tab><tab><tab><tab><spacebar>",
-    # Enable Remote Login
-    "<wait10s><down><down><down><down><spacebar><tab><tab><spacebar>",
+    "<wait10s><leftAltOn>f<leftAltOff>sharing<enter>",
+    # Navigate to "Screen Sharing" and enable it
+    "<wait10s><tab><tab><tab><tab><tab><spacebar>",
+    # Navigate to "Remote Login" and enable it
+    "<wait10s><tab><tab><tab><tab><tab><tab><tab><tab><tab><tab><tab><tab><spacebar>",
     # Disable Voice Over
     "<leftAltOn><f5><leftAltOff>",
   ]
@@ -82,7 +86,7 @@ build {
   provisioner "shell" {
     inline = [
       // Enable passwordless sudo
-      "echo admin | sudo -S sh -c \"echo 'admin ALL=(ALL) NOPASSWD: ALL' | EDITOR=tee visudo /etc/sudoers.d/admin-nopasswd\"",
+      "echo admin | sudo -S sh -c \"mkdir -p /etc/sudoers.d/; echo 'admin ALL=(ALL) NOPASSWD: ALL' | EDITOR=tee visudo /etc/sudoers.d/admin-nopasswd\"",
       // Enable auto-login
       //
       // See https://github.com/xfreebird/kcpassword for details.
@@ -90,18 +94,20 @@ build {
       "sudo defaults write /Library/Preferences/com.apple.loginwindow autoLoginUser admin",
       // Disable screensaver at login screen
       "sudo defaults write /Library/Preferences/com.apple.screensaver loginWindowIdleTime 0",
+      // Disable screensaver for admin user
+      "defaults -currentHost write com.apple.screensaver idleTime 0",
       // Prevent the VM from sleeping
-      "sudo systemsetup -setdisplaysleep Off",
-      "sudo systemsetup -setsleep Off",
-      "sudo systemsetup -setcomputersleep Off",
+      "sudo systemsetup -setdisplaysleep Off 2>/dev/null",
+      "sudo systemsetup -setsleep Off 2>/dev/null",
+      "sudo systemsetup -setcomputersleep Off 2>/dev/null",
       // Launch Safari to populate the defaults
       "/Applications/Safari.app/Contents/MacOS/Safari &",
-      "sleep 3",
-      "kill -9 %1",
-      // Enable Safari's remote automation and "Develop" menu
+      "SAFARI_PID=$!",
+      "disown",
+      "sleep 30",
+      "kill -9 $SAFARI_PID",
+      // Enable Safari's remote automation
       "sudo safaridriver --enable",
-      "defaults write com.apple.Safari.SandboxBroker ShowDevelopMenu -bool true",
-      "defaults write com.apple.Safari IncludeDevelopMenu -bool true",
       // Disable screen lock
       //
       // Note that this only works if the user is logged-in,

templates/vanilla-ventura.pkr.hcl

@@ -1,7 +1,7 @@
 packer {
   required_plugins {
     tart = {
-      version = ">= 0.5.4"
+      version = ">= 1.12.0"
       source  = "github.com/cirruslabs/tart"
     }
   }
@@ -10,7 +10,7 @@ packer {
 source "tart-cli" "tart" {
   # You can find macOS IPSW URLs on various websites like https://ipsw.me/
   # and https://www.theiphonewiki.com/wiki/Beta_Firmware/Mac/13.x
-  from_ipsw    = "https://updates.cdn-apple.com/2023WinterFCS/fullrestores/032-48346/EFF99C1E-C408-4E7A-A448-12E1468AF06C/UniversalMac_13.2.1_22D68_Restore.ipsw"
+  from_ipsw    = "https://updates.cdn-apple.com/2023FallFCS/fullrestores/042-55833/C0830847-A2F8-458F-B680-967991820931/UniversalMac_13.6_22G120_Restore.ipsw"
   vm_name      = "ventura-vanilla"
   cpu_count    = 4
   memory_gb    = 8
@@ -21,8 +21,14 @@ source "tart-cli" "tart" {
   boot_command = [
     # hello, hola, bonjour, etc.
     "<wait60s><spacebar>",
-    # Language
-    "<wait30s>english<enter>",
+    # Language: most of the times we have a list of "English"[1], "English (UK)", etc. with
+    # "English" language already selected. If we type "english", it'll cause us to switch
+    # to the "English (UK)", which is not what we want. To solve this, we switch to some other
+    # language first, e.g. "Italiano" and then switch back to "English". We'll then jump to the
+    # first entry in a list of "english"-prefixed items, which will be "English".
+    #
+    # [1]: should be named "English (US)", but oh well 🤷
+    "<wait30s>italiano<esc>english<enter>",
     # Select Your Country and Region
     "<wait30s>united states<leftShiftOn><tab><leftShiftOff><spacebar>",
     # Written and Spoken Languages
@@ -88,7 +94,7 @@ build {
   provisioner "shell" {
     inline = [
       // Enable passwordless sudo
-      "echo admin | sudo -S sh -c \"echo 'admin ALL=(ALL) NOPASSWD: ALL' | EDITOR=tee visudo /etc/sudoers.d/admin-nopasswd\"",
+      "echo admin | sudo -S sh -c \"mkdir -p /etc/sudoers.d/; echo 'admin ALL=(ALL) NOPASSWD: ALL' | EDITOR=tee visudo /etc/sudoers.d/admin-nopasswd\"",
       // Enable auto-login
       //
       // See https://github.com/xfreebird/kcpassword for details.
@@ -96,23 +102,26 @@ build {
       "sudo defaults write /Library/Preferences/com.apple.loginwindow autoLoginUser admin",
       // Disable screensaver at login screen
       "sudo defaults write /Library/Preferences/com.apple.screensaver loginWindowIdleTime 0",
+      // Disable screensaver for admin user
+      "defaults -currentHost write com.apple.screensaver idleTime 0",
       // Prevent the VM from sleeping
-      "sudo systemsetup -setdisplaysleep Off",
-      "sudo systemsetup -setsleep Off",
-      "sudo systemsetup -setcomputersleep Off",
+      "sudo systemsetup -setdisplaysleep Off 2>/dev/null",
+      "sudo systemsetup -setsleep Off 2>/dev/null",
+      "sudo systemsetup -setcomputersleep Off 2>/dev/null",
       // Launch Safari to populate the defaults
       "/Applications/Safari.app/Contents/MacOS/Safari &",
+      "SAFARI_PID=$!",
+      "disown",
       "sleep 30",
-      "kill -9 %1",
-      // Enable Safari's remote automation and "Develop" menu
+      "kill -9 $SAFARI_PID",
+      // Enable Safari's remote automation
       "sudo safaridriver --enable",
-      "defaults write com.apple.Safari.SandboxBroker ShowDevelopMenu -bool true",
-      "defaults write com.apple.Safari IncludeDevelopMenu -bool true",
       // Disable screen lock
       //
       // Note that this only works if the user is logged-in,
       // i.e. not on login screen.
       "sysadminctl -screenLock off -password admin",
+      "defaults -currentHost write com.apple.screensaver idleTime 0"
     ]
   }
 }

templates/xcode.pkr.hcl

@@ -1,71 +1,107 @@
 packer {
   required_plugins {
     tart = {
-      version = ">= 0.5.4"
+      version = ">= 1.12.0"
       source  = "github.com/cirruslabs/tart"
     }
   }
 }
 
 variable "macos_version" {
-  type =  string
+  type = string
 }
 
 variable "xcode_version" {
-  type =  string
+  type = list(string)
 }
 
-variable "gha_version" {
-  type =  string
+variable "additional_runtimes" {
+  type = list(string)
+  default = []
+}
+
+variable "tag" {
+  type = string
+  default = ""
+}
+
+variable "disk_size" {
+  type = number
+  default = 100
+}
+
+variable "disk_free_mb" {
+  type = number
+  default = 15000
 }
 
 variable "android_sdk_tools_version" {
-  type =  string
-  default = "9477386" # https://developer.android.com/studio/#command-tools
+  type    = string
+  default = "11076708" # https://developer.android.com/studio/#command-tools
 }
 
 source "tart-cli" "tart" {
-  vm_base_name = "${var.macos_version}-base"
-  vm_name      = "${var.macos_version}-xcode:${var.xcode_version}"
+  vm_base_name = "ghcr.io/cirruslabs/macos-${var.macos_version}-base:latest"
+  // use tag or the last element of the xcode_version list
+  vm_name      = "${var.macos_version}-xcode:${var.tag != "" ? var.tag : var.xcode_version[0]}"
   cpu_count    = 4
   memory_gb    = 8
-  disk_size_gb = 90
+  disk_size_gb = var.disk_size
   headless     = true
   ssh_password = "admin"
   ssh_username = "admin"
   ssh_timeout  = "120s"
 }
 
+locals {
+  xcode_install_provisioners = [
+    for version in reverse(sort(var.xcode_version)) : {
+      type = "shell"
+      inline = [
+        "source ~/.zprofile",
+        "sudo xcodes install ${version} --experimental-unxip --path /Users/admin/Downloads/Xcode_${version}.xip --select --empty-trash",
+        // get selected xcode path, strip /Contents/Developer and move to GitHub compatible locations
+        "INSTALLED_PATH=$(xcodes select -p)",
+        "CONTENTS_DIR=$(dirname $INSTALLED_PATH)",
+        "APP_DIR=$(dirname $CONTENTS_DIR)",
+        "sudo mv $APP_DIR /Applications/Xcode_${version}.app",
+        "sudo xcode-select -s /Applications/Xcode_${version}.app",
+        "xcodebuild -downloadAllPlatforms",
+        "xcodebuild -runFirstLaunch",
+      ]
+    }
+  ]
+}
+
 build {
   sources = ["source.tart-cli.tart"]
 
-  // re-install the actions runner
-  provisioner "shell" {
-    inline = [
-      "cd $HOME",
-      "rm -rf actions-runner",
-      "mkdir actions-runner && cd actions-runner",
-      "curl -O -L https://github.com/actions/runner/releases/download/v${var.gha_version}/actions-runner-osx-arm64-${var.gha_version}.tar.gz",
-      "tar xzf ./actions-runner-osx-arm64-${var.gha_version}.tar.gz",
-      "rm actions-runner-osx-arm64-${var.gha_version}.tar.gz",
-    ]
-  }
-
   provisioner "shell" {
     inline = [
       "source ~/.zprofile",
       "brew --version",
       "brew update",
       "brew upgrade",
-      "brew install curl wget unzip zip ca-certificates",
-      "sudo softwareupdate --install-rosetta --agree-to-license"
+    ]
+  }
+
+  // Re-install the GitHub Actions runner
+  provisioner "shell" {
+    script = "scripts/install-actions-runner.sh"
+  }
+
+  // make sure our workaround from base is still valid
+  provisioner "shell" {
+    inline = [
+      "sudo ln -s /Users/admin /Users/runner || true"
     ]
   }
 
   provisioner "shell" {
     inline = [
       "source ~/.zprofile",
-      "brew install homebrew/cask-versions/temurin11",
+      "brew install openjdk@17",
+      "echo 'export PATH=\"/opt/homebrew/opt/openjdk@17/bin:$PATH\"' >> ~/.zprofile",
       "echo 'export ANDROID_HOME=$HOME/android-sdk' >> ~/.zprofile",
       "echo 'export ANDROID_SDK_ROOT=$ANDROID_HOME' >> ~/.zprofile",
       "echo 'export PATH=$PATH:$ANDROID_HOME/cmdline-tools/latest/bin:$ANDROID_HOME/platform-tools:$ANDROID_HOME/emulator' >> ~/.zprofile",
@@ -76,28 +112,49 @@ build {
       "rm android-sdk-tools.zip",
       "mv $ANDROID_HOME/cmdline-tools/cmdline-tools $ANDROID_HOME/cmdline-tools/latest",
       "yes | sdkmanager --licenses",
-      "yes | sdkmanager 'platform-tools' 'platforms;android-33' 'build-tools;33.0.1' 'ndk;25.1.8937393'"
+      "yes | sdkmanager 'platform-tools' 'platforms;android-33' 'build-tools;34.0.0' 'ndk;25.2.9519653'"
     ]
   }
+
   provisioner "shell" {
     inline = [
-      "echo 'export PATH=/usr/local/bin/:$PATH' >> ~/.zprofile",
       "source ~/.zprofile",
-      "wget --quiet https://github.com/RobotsAndPencils/xcodes/releases/latest/download/xcodes.zip",
-      "unzip xcodes.zip",
-      "rm xcodes.zip",
-      "chmod +x xcodes",
-      "sudo mkdir -p /usr/local/bin/",
-      "sudo mv xcodes /usr/local/bin/xcodes",
+      "brew install xcodesorg/made/xcodes",
       "xcodes version",
-      "wget --quiet https://storage.googleapis.com/xcodes-cache/Xcode_${var.xcode_version}.xip",
-      "xcodes install ${var.xcode_version} --experimental-unxip --path $PWD/Xcode_${var.xcode_version}.xip",
-      "sudo rm -rf ~/.Trash/*",
-      "xcodes select ${var.xcode_version}",
-      "xcodebuild -downloadAllPlatforms",
-      "xcodebuild -runFirstLaunch",
     ]
   }
+
+  provisioner "file" {
+    sources      = [ for version in var.xcode_version : pathexpand("~/XcodesCache/Xcode_${version}.xip")]
+    destination = "/Users/admin/Downloads/"
+  }
+
+  // iterate over all Xcode versions and install them
+  // select the latest one as the default
+  dynamic "provisioner" {
+    for_each = local.xcode_install_provisioners
+    labels = ["shell"]
+    content {
+      inline = provisioner.value.inline
+    }
+  }
+
+  provisioner "shell" {
+    inline = [
+      "source ~/.zprofile",
+      "sudo xcodes select '${var.xcode_version[0]}'",
+    ]
+  }
+
+  provisioner "shell" {
+    inline = concat(
+      ["source ~/.zprofile"],
+      [
+        for runtime in var.additional_runtimes : "sudo xcodes runtimes install ${runtime}"
+      ]
+    )
+  }
+
   provisioner "shell" {
     inline = [
       "source ~/.zprofile",
@@ -116,30 +173,60 @@ build {
     inline = [
       "source ~/.zprofile",
       "brew install libimobiledevice ideviceinstaller ios-deploy fastlane carthage",
-      "sudo gem update",
-      "sudo gem install cocoapods",
-      "sudo gem uninstall --ignore-dependencies ffi && sudo gem install ffi -- --enable-libffi-alloc"
+      "brew install xcbeautify",
+      "gem update",
+      "gem install cocoapods",
+      "gem install xcpretty",
+      "gem uninstall --ignore-dependencies ffi && gem install ffi -- --enable-libffi-alloc"
     ]
   }
+
+  # useful utils for mobile development
+  provisioner "shell" {
+    inline = [
+      "source ~/.zprofile",
+      "brew install graphicsmagick imagemagick",
+      "brew install wix/brew/applesimutils",
+      "brew install gnupg"
+    ]
+  }
+
   # inspired by https://github.com/actions/runner-images/blob/fb3b6fd69957772c1596848e2daaec69eabca1bb/images/macos/provision/configuration/configure-machine.sh#L33-L61
   provisioner "shell" {
     inline = [
       "source ~/.zprofile",
-      "sudo security delete-certificate -Z FF6797793A3CD798DC5B2ABEF56F73EDC9F83A64 /Library/Keychains/System.keychain",
-      "curl -o add-certificate.swift https://raw.githubusercontent.com/actions/runner-images/fb3b6fd69957772c1596848e2daaec69eabca1bb/images/macos/provision/configuration/add-certificate.swift",
-      "swiftc add-certificate.swift",
       "curl -o AppleWWDRCAG3.cer https://www.apple.com/certificateauthority/AppleWWDRCAG3.cer",
       "curl -o DeveloperIDG2CA.cer https://www.apple.com/certificateauthority/DeveloperIDG2CA.cer",
+      "curl -o add-certificate.swift https://raw.githubusercontent.com/actions/runner-images/fb3b6fd69957772c1596848e2daaec69eabca1bb/images/macos/provision/configuration/add-certificate.swift",
+      "swiftc -suppress-warnings add-certificate.swift",
       "sudo ./add-certificate AppleWWDRCAG3.cer",
       "sudo ./add-certificate DeveloperIDG2CA.cer",
       "rm add-certificate* *.cer"
     ]
   }
+
   provisioner "shell" {
     inline = [
       "source ~/.zprofile",
-      "brew doctor",
       "flutter doctor"
     ]
   }
+
+  // check there is at least 15GB of free space and fail if not
+  provisioner "shell" {
+    inline = [
+      "source ~/.zprofile",
+      "df -h",
+      "export FREE_MB=$(df -m | awk '{print $4}' | head -n 2 | tail -n 1)",
+      "[[ $FREE_MB -gt ${var.disk_free_mb} ]] && echo OK || exit 1"
+    ]
+  }
+
+  // some other health checks
+  provisioner "shell" {
+    inline = [
+      "source ~/.zprofile",
+      "test -d /Users/runner"
+    ]
+  }
 }

variables.pkrvars.hcl

@@ -1,3 +0,0 @@
-macos_version = "ventura"
-gha_version   = "2.303.0"
-xcode_version = "14.2"