Use xargs fix for all vanilla images, not just Sequoia

.ci/cirrus.base.yml

@@ -9,6 +9,8 @@ task:
   <<: *defaults
   pull_vanilla_script:
     - tart pull ghcr.io/cirruslabs/macos-$MACOS_VERSION-vanilla:latest
+  install_sshpass_script:
+    - brew install sshpass
   build_base_script:
     - packer init templates/base.pkr.hcl
     - packer build -var macos_version="$MACOS_VERSION" templates/base.pkr.hcl

.ci/cirrus.runner.yml

@@ -7,9 +7,8 @@ task:
         XCODE_VERSIONS: "16.1,16,15.4,15.3,15.2,15.1,\"15.0.1\""
         DISK_SIZE: 375
       - MACOS_VERSION: sequoia
-        XCODE_VERSIONS: "16.2,\"16.3-beta-2\",16.1,16,15.4"
-        ADDITIONAL_IOS_BUILDS: "18.2"
-        DISK_SIZE: 375
+        XCODE_VERSIONS: "16.2,16.1,16,15.4"
+        DISK_SIZE: 320
   <<: *defaults
   pull_base_script:
     - tart pull ghcr.io/cirruslabs/macos-$MACOS_VERSION-base:latest
@@ -19,7 +18,7 @@ task:
         -var disk_free_mb=100000 \
         -var macos_version="$MACOS_VERSION" \
         -var xcode_version="[$XCODE_VERSIONS]" \
-        -var additional_ios_builds="[$ADDITIONAL_IOS_BUILDS]" \
+        -var additional_runtimes="[$ADDITIONAL_RUNTIMES]" \
         templates/xcode.pkr.hcl
   push_script: |
     tart push "$MACOS_VERSION-xcode:runner" ghcr.io/cirruslabs/macos-runner:$MACOS_VERSION

.ci/cirrus.vanilla.yml

@@ -1,4 +1,5 @@
 env:
+  RESOLVE_VM_BASE_NAME: "ghcr.io/cirruslabs/macos-${MACOS_VERSION}-vanilla:latest"
   RESOLVE_VM_NAME: "resolve-macos-number-task-id-${CIRRUS_TASK_ID}"
   RESOLVE_FILE: "${RESOLVE_VM_NAME}.txt"
 
@@ -18,7 +19,7 @@ task:
   disable_sip_script:
     - packer build -var vm_name=$MACOS_VERSION-vanilla templates/disable-sip.pkr.hcl
   resolve_macos_number_script:
-    - packer build -var vm_base_name=$MACOS_VERSION-vanilla -var vm_name=$RESOLVE_VM_NAME -var resolve_file=$RESOLVE_FILE templates/resolve-macos-number.pkr.hcl
+    - packer build -var vm_base_name=$RESOLVE_VM_BASE_NAME -var vm_name=$RESOLVE_VM_NAME -var resolve_file=$RESOLVE_FILE templates/resolve-macos-number.pkr.hcl
     - echo "MACOS_NUMBER=$(cat $RESOLVE_FILE)" >> $CIRRUS_ENV
     - rm $RESOLVE_FILE
     - tart delete $RESOLVE_VM_NAME

README.md

@@ -26,7 +26,7 @@ monthly on the first Saturday of the month:
 
 * `ghcr.io/cirruslabs/macos-{sequoia,sonoma}-base`
 * `ghcr.io/cirruslabs/macos-runner:sonoma` which is a superset of `ghcr.io/cirruslabs/macos-sonoma-xcode:{latest,16.1,16,15.4,15.3,15.2,15.1,15.0.1}`
-* `ghcr.io/cirruslabs/macos-runner:sequoia` which is a superset of `ghcr.io/cirruslabs/macos-sequoia-xcode:{latest,16.2,16.3-beta-2,16.1,16,15.4}`
+* `ghcr.io/cirruslabs/macos-runner:sequoia` which is a superset of `ghcr.io/cirruslabs/macos-sequoia-xcode:{latest,16.2,16.1,16,15.4}`
 
 Note that `ghcr.io/cirruslabs/macos-runner:{sequoia,sonoma}` are updated every Sunday and these images are [optimised for startup](https://cirrus-runners.app/blog/2024/04/11/optimizing-startup-time-of-cirrus-runners/)
 on Cirrus Runners and Cirrus CI services.

ansible/roles/system-updater/tasks/main.yml

@@ -17,21 +17,11 @@
     recurse: yes
   become: yes
 
-- name: "ensure that there are no more software updates available: check for available updates"
-  command:
-    cmd: "softwareupdate --all --list"
-  register: software_updates_result
+- name: Ensure that there are no more software updates available (1/2)
+  command: "softwareupdate --all --list"
+  register: check_updates_result
 
-- name: "ensure that there are no more software updates available: parse available updates"
-  set_fact:
-    software_updates: "{{ software_updates_result.stdout | regex_findall('\\* Label: (.*)\\n\\tTitle: (.*), Version: (.*), Size: (.*), Recommended: (.*), Action: (.*), .*') | map('zip', ['label', 'title', 'version', 'size', 'recommended', 'action']) | map('map', 'reverse') | map('community.general.dict') }}"
-
-- name: "ensure that there are no more software updates available: print available updates"
-  debug:
-    var: software_updates
-
-- name: "ensure that there are no more software updates available: fail if some updates were not installed"
-  fail:
-    msg: "Found unapplied update: {{ item.label }}"
-  loop: "{{ software_updates }}"
-  when: "not item.label.startswith('macOS') or item.version.split('.')[0] == ansible_facts['distribution_version'].split('.')[0]"
+- name: Ensure that there are no more software updates available (2/2)
+  assert:
+    that:
+      - "'No new software available' in check_updates_result.stderr"

ansible/roles/system-updater/tasks/softwareupdate.yml

@@ -1,21 +1,8 @@
-- name: check for available updates
-  command:
-    cmd: "softwareupdate --all --list"
-  register: software_updates_result
-
-- name: parse available updates
-  set_fact:
-    software_updates: "{{ software_updates_result.stdout | regex_findall('\\* Label: (.*)\\n\\tTitle: (.*), Version: (.*), Size: (.*), Recommended: (.*), Action: (.*), .*') | map('zip', ['label', 'title', 'version', 'size', 'recommended', 'action']) | map('map', 'reverse') | map('community.general.dict') }}"
-
-- name: print available updates
-  debug:
-    var: software_updates
-
 # It seems that we must always pass "--restart" command-line argument to "softwareupdate",
 # otherwise on the OS update the "softwareupdate" will be stuck at "Downloaded: macOS [...]"
-- name: install available update
+- name: install all macOS updates
   command:
-    cmd: "softwareupdate --install --agree-to-license --force --restart --user admin --stdinpass {{ stdinpass | default('') }} '{{ item.label }}'"
+    cmd: "softwareupdate --all --install --agree-to-license --force --restart --user admin --stdinpass"
     stdin: "{{ ansible_password }}"
   register: update_result
   # Work around the following:
@@ -24,13 +11,9 @@
   # > ssh: connect to host [...] port 22: Connection refused.
   ignore_unreachable: yes
   # Ignore SIGTERM/SIGKILL sent "softwareupdate" process
-  # when the system reboots due to --restart and any other errors,
-  # since we'll check whether the update was installed in main.yml
-  # anyway.
-  ignore_errors: yes
+  # when the system reboots due to --restart
+  failed_when: update_result.rc not in [0, 9, -9, 15, -15]
   become: yes
-  loop: "{{ software_updates }}"
-  when: "not item.label.startswith('macOS') or item.version.split('.')[0] == ansible_facts['distribution_version'].split('.')[0]"
 
 # Wait for the connection since the previous command could restart the host
 - name: wait for connection
@@ -40,4 +23,4 @@
     # the commands below on a non-restarted system.
     delay: 60
     timeout: 1800
-  when: update_result is defined and not update_result.skipped | default(false)
+  when: "'No updates are available' not in (update_result.stderr_lines | join('\n'))"

data/setup-info-template.json

@@ -1,40 +0,0 @@
-[
-  {
-    "group": "Runner Detail",
-    "detail": [
-      {
-        "name": "OS Information",
-        "script": "echo \"macOS $(sw_vers -productVersion) ($(sw_vers -buildVersion))\""
-      },
-      {
-        "name": "Build Date",
-        "script": "date +\"%Y-%m-%d\""
-      }
-    ]
-  },
-  {
-    "group": "Software Detail",
-    "detail": [
-      {
-        "name": "Python Version",
-        "script": "python3 --version"
-      },
-      {
-        "name": "Node Version",
-        "script": "node --version"
-      },
-      {
-        "name": "Ruby Version",
-        "script": "ruby --version"
-      },
-      {
-        "name": "CocoaPods Version",
-        "script": "pod --version"
-      },
-      {
-        "name": "Fastlane Version",
-        "script": "fastlane --version"
-      }
-    ]
-  }
-]

templates/resolve-macos-number.pkr.hcl

@@ -34,9 +34,7 @@ build {
 
   provisioner "shell" {
     inline = [
-      # Use "-productVersion" instead of "--productVersion"
-      # to support old-style syntax used on macOS Monterey
-      "sw_vers -productVersion > /tmp/sw-vers-product-version.txt",
+      "sw_vers --productVersion > /tmp/sw-vers-product-version.txt",
     ]
   }
 

templates/vanilla-monterey.pkr.hcl

@@ -17,7 +17,7 @@ source "tart-cli" "tart" {
   vm_name      = "monterey-vanilla"
   cpu_count    = 4
   memory_gb    = 8
-  disk_size_gb = 50
+  disk_size_gb = 40
   ssh_password = "admin"
   ssh_username = "admin"
   ssh_timeout  = "120s"
@@ -135,14 +135,5 @@ build {
 
   provisioner "ansible" {
     playbook_file = "ansible/playbook-system-updater.yml"
-    extra_arguments = [
-      "-vvv",
-      "--extra-vars", "stdinpass=admin",
-    ]
-    ansible_env_vars = [
-      "ANSIBLE_TRANSPORT=paramiko",
-      "ANSIBLE_HOST_KEY_CHECKING=False",
-    ]
-    use_proxy = false
   }
 }

templates/vanilla-sequoia.pkr.hcl

@@ -12,11 +12,11 @@ packer {
 }
 
 source "tart-cli" "tart" {
-  from_ipsw    = "https://updates.cdn-apple.com/2025SpringFCS/fullrestores/082-16517/AACDDC33-9683-4431-98AF-F04EF7C15EE3/UniversalMac_15.4_24E248_Restore.ipsw"
+  from_ipsw    = "https://updates.cdn-apple.com/2025WinterFCS/fullrestores/072-08269/7CAAB9F7-E970-428D-8764-4CD7BCD105CD/UniversalMac_15.3_24D60_Restore.ipsw"
   vm_name      = "sequoia-vanilla"
   cpu_count    = 4
   memory_gb    = 8
-  disk_size_gb = 50
+  disk_size_gb = 40
   ssh_password = "admin"
   ssh_username = "admin"
   ssh_timeout  = "300s"
@@ -31,30 +31,28 @@ source "tart-cli" "tart" {
     #
     # [1]: should be named "English (US)", but oh well 🤷
     "<wait30s>italiano<esc>english<enter>",
-    # Select Your Country or Region
+    # Select Your Country and Region
     "<wait30s>united states<leftShiftOn><tab><leftShiftOff><spacebar>",
-    # Transfer Your Data to This Mac
-    "<wait10s><tab><tab><tab><spacebar><tab><tab><spacebar>",
     # Written and Spoken Languages
     "<wait10s><leftShiftOn><tab><leftShiftOff><spacebar>",
     # Accessibility
     "<wait10s><leftShiftOn><tab><leftShiftOff><spacebar>",
     # Data & Privacy
     "<wait10s><leftShiftOn><tab><leftShiftOff><spacebar>",
-    # Create a Mac Account
-    "<wait10s>Managed via Tart<tab>admin<tab>admin<tab>admin<tab><tab><spacebar><tab><tab><spacebar>",
-    # Enable Voice Over
-    "<wait120s><leftAltOn><f5><leftAltOff>",
+    # Migration Assistant
+    "<wait10s><tab><tab><tab><spacebar>",
     # Sign In with Your Apple ID
-    "<wait10s><leftShiftOn><tab><leftShiftOff><spacebar>",
+    "<wait10s><leftShiftOn><tab><leftShiftOff><leftShiftOn><tab><leftShiftOff><spacebar>",
     # Are you sure you want to skip signing in with an Apple ID?
     "<wait10s><tab><spacebar>",
     # Terms and Conditions
     "<wait10s><leftShiftOn><tab><leftShiftOff><spacebar>",
     # I have read and agree to the macOS Software License Agreement
     "<wait10s><tab><spacebar>",
+    # Create a Computer Account
+    "<wait10s>admin<tab><tab>admin<tab>admin<tab><tab><tab><spacebar>",
     # Enable Location Services
-    "<wait10s><leftShiftOn><tab><leftShiftOff><spacebar>",
+    "<wait120s><leftShiftOn><tab><leftShiftOff><spacebar>",
     # Are you sure you don't want to use Location Services?
     "<wait10s><tab><spacebar>",
     # Select Your Time Zone
@@ -67,12 +65,8 @@ source "tart-cli" "tart" {
     "<wait10s><tab><spacebar><leftShiftOn><tab><leftShiftOff><spacebar>",
     # Choose Your Look
     "<wait10s><leftShiftOn><tab><leftShiftOff><spacebar>",
-    # Update Mac Automatically
-    "<wait10s><tab><spacebar>",
     # Welcome to Mac
     "<wait10s><spacebar>",
-    # Disable Voice Over
-    "<leftAltOn><f5><leftAltOff>",
     # Enable Keyboard navigation
     # This is so that we can navigate the System Settings app using the keyboard
     "<wait10s><leftAltOn><spacebar><leftAltOff>Terminal<enter>",
@@ -81,27 +75,13 @@ source "tart-cli" "tart" {
     # Now that the installation is done, open "System Settings"
     "<wait10s><leftAltOn><spacebar><leftAltOff>System Settings<enter>",
     # Navigate to "Sharing"
-    "<wait10s><leftCtrlOn><f2><leftCtrlOff><right><right><right><down>Sharing<enter>",
+    "<wait10s><leftAltOn>f<leftAltOff>sharing<enter>",
     # Navigate to "Screen Sharing" and enable it
-    "<wait10s><tab><tab><tab><tab><tab><tab><tab><spacebar>",
+    "<wait10s><tab><tab><tab><tab><tab><spacebar>",
     # Navigate to "Remote Login" and enable it
     "<wait10s><tab><tab><tab><tab><tab><tab><tab><tab><tab><tab><tab><tab><spacebar>",
     # Quit System Settings
     "<wait10s><leftAltOn>q<leftAltOff>",
-    # Disable Gatekeeper (1/2)
-    "<wait10s><leftAltOn><spacebar><leftAltOff>Terminal<enter>",
-    "<wait10s>sudo spctl --global-disable<enter>",
-    "<wait10s>admin<enter>",
-    "<wait10s><leftAltOn>q<leftAltOff>",
-    # Disable Gatekeeper (2/2)
-    "<wait10s><leftAltOn><spacebar><leftAltOff>System Settings<enter>",
-    "<wait10s><leftCtrlOn><f2><leftCtrlOff><right><right><right><down>Privacy & Security<enter>",
-    "<wait10s><leftShiftOn><tab><leftShiftOff><leftShiftOn><tab><leftShiftOff><leftShiftOn><tab><leftShiftOff><leftShiftOn><tab><leftShiftOff><leftShiftOn><tab><leftShiftOff><leftShiftOn><tab><leftShiftOff><leftShiftOn><tab><leftShiftOff>",
-    "<wait10s><down><wait1s><down><wait1s><enter>",
-    "<wait10s>admin<enter>",
-    "<wait10s><leftShiftOn><tab><leftShiftOff><wait1s><spacebar>",
-    # Quit System Settings
-    "<wait10s><leftAltOn>q<leftAltOff>",
   ]
 
   // A (hopefully) temporary workaround for Virtualization.Framework's
@@ -146,13 +126,6 @@ build {
     ]
   }
 
-  provisioner "shell" {
-    inline = [
-      # Ensure that Gatekeeper is disabled
-      "spctl --status | grep -q 'assessments disabled'"
-    ]
-  }
-
   provisioner "shell" {
     inline = [
       # Install command-line tools
@@ -164,13 +137,5 @@ build {
 
   provisioner "ansible" {
     playbook_file = "ansible/playbook-system-updater.yml"
-    extra_arguments = [
-      "-vvv",
-    ]
-    ansible_env_vars = [
-      "ANSIBLE_TRANSPORT=paramiko",
-      "ANSIBLE_HOST_KEY_CHECKING=False",
-    ]
-    use_proxy = false
   }
 }

templates/vanilla-sonoma.pkr.hcl

@@ -16,7 +16,7 @@ source "tart-cli" "tart" {
   vm_name      = "sonoma-vanilla"
   cpu_count    = 4
   memory_gb    = 8
-  disk_size_gb = 50
+  disk_size_gb = 40
   ssh_password = "admin"
   ssh_username = "admin"
   ssh_timeout  = "120s"
@@ -134,13 +134,5 @@ build {
 
   provisioner "ansible" {
     playbook_file = "ansible/playbook-system-updater.yml"
-    extra_arguments = [
-      "-vvv",
-    ]
-    ansible_env_vars = [
-      "ANSIBLE_TRANSPORT=paramiko",
-      "ANSIBLE_HOST_KEY_CHECKING=False",
-    ]
-    use_proxy = false
   }
 }

templates/vanilla-ventura.pkr.hcl

@@ -18,7 +18,7 @@ source "tart-cli" "tart" {
   vm_name      = "ventura-vanilla"
   cpu_count    = 4
   memory_gb    = 8
-  disk_size_gb = 50
+  disk_size_gb = 40
   ssh_password = "admin"
   ssh_username = "admin"
   ssh_timeout  = "120s"
@@ -143,13 +143,5 @@ build {
 
   provisioner "ansible" {
     playbook_file = "ansible/playbook-system-updater.yml"
-    extra_arguments = [
-      "-vvv",
-    ]
-    ansible_env_vars = [
-      "ANSIBLE_TRANSPORT=paramiko",
-      "ANSIBLE_HOST_KEY_CHECKING=False",
-    ]
-    use_proxy = false
   }
 }

templates/xcode.pkr.hcl

@@ -15,7 +15,7 @@ variable "xcode_version" {
   type = list(string)
 }
 
-variable "additional_ios_builds" {
+variable "additional_runtimes" {
   type = list(string)
   default = []
 }
@@ -150,7 +150,7 @@ build {
     inline = concat(
       ["source ~/.zprofile"],
       [
-        for runtime in var.additional_ios_builds : "xcodebuild -downloadPlatform iOS -buildVersion ${runtime}"
+        for runtime in var.additional_runtimes : "sudo xcodes runtimes install ${runtime}"
       ]
     )
   }
@@ -261,27 +261,4 @@ build {
       "sleep 1800"
     ]
   }
-
-  // Install setup-info-generator
-  provisioner "shell" {
-    inline = [
-      "source ~/.zprofile",
-      "brew install cirruslabs/cli/setup-info-generator"
-    ]
-  }
-
-  // Copy setup info template
-  provisioner "file" {
-    source      = "data/setup-info-template.json"
-    destination = "~/setup-info-template.json"
-  }
-
-  // Generate setup info
-  provisioner "shell" {
-    inline = [
-      "source ~/.zprofile",
-      "cat ~/setup-info-template.json | setup-info-generator > ~/actions-runner/.setup_info",
-      "rm ~/setup-info-template.json"
-    ]
-  }
 }