Merge pull request #364 from cirruslabs/dev/fkorotkov/tahoe-26-6-1-automation-permissions

Update Tahoe restore image and automation permissions
2026-09-30 11:51:13 +02:00 · 2026-08-07 10:38:00 -04:00 · 2026-08-07 10:24:00 -04:00 · 2026-08-06 12:20:10 -04:00 · 2026-08-06 08:36:12 -04:00 · 2026-07-05 12:00:02 -04:00
32 changed files with 1675 additions and 295 deletions
@@ -1,19 +0,0 @@
-task:
-  name: "Update Base Images ($MACOS_VERSION)"
-  alias: update-base
-  matrix:
-    - env:
-        MACOS_VERSION: sonoma
-    - env:
-        MACOS_VERSION: sequoia
-  <<: *defaults
-  pull_vanilla_script:
-    - tart pull ghcr.io/cirruslabs/macos-$MACOS_VERSION-vanilla:latest
-  build_base_script:
-    - packer init templates/base.pkr.hcl
-    - packer build -var macos_version="$MACOS_VERSION" templates/base.pkr.hcl
-  push_base_script:
-    - tart push $MACOS_VERSION-base ghcr.io/cirruslabs/macos-$MACOS_VERSION-base:latest
-  always:
-    cleanup_script:
-      - tart delete $MACOS_VERSION-base
@@ -1,21 +0,0 @@
-task:
-  name: "Release Xcode $CIRRUS_TAG ($MACOS_VERSION)"
-  matrix:
-    - env:
-        MACOS_VERSION: sequoia
-  <<: *defaults
-  pull_base_script:
-    - tart pull ghcr.io/cirruslabs/macos-$MACOS_VERSION-base:latest
-  build_script:
-    - packer init templates/xcode.pkr.hcl
-    - packer build -var macos_version="$MACOS_VERSION" -var xcode_version="[\"$CIRRUS_TAG\"]" templates/xcode.pkr.hcl
-  push_script: |
-    if [[ $CIRRUS_TAG == *"beta"* ]]
-    then
-      tart push $MACOS_VERSION-xcode:$CIRRUS_TAG ghcr.io/cirruslabs/macos-$MACOS_VERSION-xcode:$CIRRUS_TAG
-    else
-      tart push $MACOS_VERSION-xcode:$CIRRUS_TAG ghcr.io/cirruslabs/macos-$MACOS_VERSION-xcode:$CIRRUS_TAG ghcr.io/cirruslabs/macos-$MACOS_VERSION-xcode:latest
-    fi
-  always:
-    cleanup_script:
-      - tart delete $MACOS_VERSION-xcode:$CIRRUS_TAG || true
@@ -1,27 +0,0 @@
-task:
-  name: "Update Runner Image ($MACOS_VERSION)"
-  execution_lock: runner-image-update
-  env:
-    matrix:
-      - MACOS_VERSION: sonoma
-        XCODE_VERSIONS: "16.1,16,15.4,15.3,15.2,15.1,\"15.0.1\""
-        DISK_SIZE: 375
-      - MACOS_VERSION: sequoia
-        XCODE_VERSIONS: "16.2,16.1,16,15.4"
-        DISK_SIZE: 320
-  <<: *defaults
-  pull_base_script:
-    - tart pull ghcr.io/cirruslabs/macos-$MACOS_VERSION-base:latest
-  init_xcode_script: packer init templates/xcode.pkr.hcl
-  build_xcode_script: |
-      packer build -var tag=runner -var disk_size=$DISK_SIZE \
-        -var disk_free_mb=100000 \
-        -var macos_version="$MACOS_VERSION" \
-        -var xcode_version="[$XCODE_VERSIONS]" \
-        -var additional_runtimes="[$ADDITIONAL_RUNTIMES]" \
-        templates/xcode.pkr.hcl
-  push_script: |
-    tart push "$MACOS_VERSION-xcode:runner" ghcr.io/cirruslabs/macos-runner:$MACOS_VERSION
-  always:
-    cleanup_script:
-      - tart delete "$MACOS_VERSION-xcode:runner"
@@ -1,30 +0,0 @@
-env:
-  RESOLVE_VM_BASE_NAME: "ghcr.io/cirruslabs/macos-${MACOS_VERSION}-vanilla:latest"
-  RESOLVE_VM_NAME: "resolve-macos-number-task-id-${CIRRUS_TASK_ID}"
-  RESOLVE_FILE: "${RESOLVE_VM_NAME}.txt"
-
-task:
-  name: "Update Vanilla Image ($MACOS_VERSION)"
-  env:
-    matrix:
-      - MACOS_VERSION: sequoia
-      - MACOS_VERSION: sonoma
-      - MACOS_VERSION: ventura
-      - MACOS_VERSION: monterey
-  only_if: $CIRRUS_BRANCH == $CIRRUS_DEFAULT_BRANCH && changesInclude("templates/vanilla-$MACOS_VERSION.pkr.hcl")
-  <<: *defaults
-  build_script:
-    - packer init templates/vanilla-$MACOS_VERSION.pkr.hcl
-    - packer build templates/vanilla-$MACOS_VERSION.pkr.hcl
-  disable_sip_script:
-    - packer build -var vm_name=$MACOS_VERSION-vanilla templates/disable-sip.pkr.hcl
-  resolve_macos_number_script:
-    - packer build -var vm_base_name=$RESOLVE_VM_BASE_NAME -var vm_name=$RESOLVE_VM_NAME -var resolve_file=$RESOLVE_FILE templates/resolve-macos-number.pkr.hcl
-    - echo "MACOS_NUMBER=$(cat $RESOLVE_FILE)" >> $CIRRUS_ENV
-    - rm $RESOLVE_FILE
-    - tart delete $RESOLVE_VM_NAME
-  push_script:
-    - tart push $MACOS_VERSION-vanilla ghcr.io/cirruslabs/macos-$MACOS_VERSION-vanilla:latest ghcr.io/cirruslabs/macos-$MACOS_VERSION-vanilla:$MACOS_NUMBER
-  always:
-    cleanup_script:
-      - tart delete $MACOS_VERSION-vanilla
@@ -1,45 +0,0 @@
-task:
-  name: "Update Xcode Images ($MACOS_VERSION $XCODE_VERSION)"
-  depends_on: update-base
-  env:
-    matrix:
-      - MACOS_VERSION: sequoia
-        XCODE_VERSION: 16.2
-        LATEST: true
-      - MACOS_VERSION: sequoia
-        XCODE_VERSION: 16.1
-      - MACOS_VERSION: sequoia
-        XCODE_VERSION: 16
-      - MACOS_VERSION: sequoia
-        XCODE_VERSION: 15.4
-      - MACOS_VERSION: sonoma
-        XCODE_VERSION: 16.1
-        LATEST: true
-      - MACOS_VERSION: sonoma
-        XCODE_VERSION: 16
-      - MACOS_VERSION: sonoma
-        XCODE_VERSION: 15.4
-      - MACOS_VERSION: sonoma
-        XCODE_VERSION: 15.3
-      - MACOS_VERSION: sonoma
-        XCODE_VERSION: 15.2
-      - MACOS_VERSION: sonoma
-        XCODE_VERSION: 15.1
-      - MACOS_VERSION: sonoma
-        XCODE_VERSION: 15.0.1
-  <<: *defaults
-  pull_base_script:
-    - tart pull ghcr.io/cirruslabs/macos-$MACOS_VERSION-base:latest
-  build_xcode_script:
-    - packer init templates/xcode.pkr.hcl
-    - packer build -var macos_version="$MACOS_VERSION" -var xcode_version="[\"$XCODE_VERSION\"]" templates/xcode.pkr.hcl
-  push_script: |
-    if [[ -z "$LATEST" ]]
-    then
-      tart push "$MACOS_VERSION-xcode:$XCODE_VERSION" ghcr.io/cirruslabs/macos-$MACOS_VERSION-xcode:$XCODE_VERSION
-    else
-      tart push "$MACOS_VERSION-xcode:$XCODE_VERSION" ghcr.io/cirruslabs/macos-$MACOS_VERSION-xcode:$XCODE_VERSION ghcr.io/cirruslabs/macos-$MACOS_VERSION-xcode:latest
-    fi
-  always:
-    cleanup_script:
-      - tart delete "$MACOS_VERSION-xcode:$XCODE_VERSION"
@@ -1,51 +0,0 @@
-load("cirrus", "env", "http", "fs")
-load("github.com/cirrus-modules/graphql", "rerun_task_if_issue_in_logs")
-
-
-def on_task_failed(ctx):
-  if ctx.payload.data.task.automaticReRun:
-    print("Task is already an automatic re-run! Won't even try to re-run it...")
-    return
-  rerun_task_if_issue_in_logs(ctx.payload.data.task.id, "The network connection was lost")
-
-
-def on_build_failed(ctx):
-  # Only send Slack notifications for failed cron builds[1]
-  #
-  # [1]: https://cirrus-ci.org/guide/writing-tasks/#cron-builds
-  if "Cron" not in ctx.payload.data.build.changeMessageTitle:
-    return
-
-  resp = http.post(env.get("SLACK_WEBHOOK_URL"), headers={
-    "Content-Type": "application/json",
-  }, json_body={
-    "text": "Build {build_id} (\"{change_message_title}\") failed on branch \"{branch_name}\" in repository \"{repository_name}\".".format(
-      build_id=ctx.payload.data.build.id,
-      change_message_title=ctx.payload.data.build.changeMessageTitle,
-      branch_name=ctx.payload.data.build.branch,
-      repository_name=ctx.payload.data.repository.name,
-    ),
-    "url": "https://cirrus-ci.com/build/{build_id}".format(
-      build_id=ctx.payload.data.build.id,
-    ),
-  })
-
-  if resp.status_code != 200:
-    fail("failed to post message to Slack: got unexpected HTTP {}".format(resp.status_code))
-
-  resp_json = resp.json()
-
-  if resp_json["ok"] != True:
-    fail("got error when posting message to Slack: {}".format(resp_json["error"]))
-
-
-def main(ctx):
-  result = fs.read(".ci/cirrus.vanilla.yml")
-  if env.get("CIRRUS_TAG") != None:
-    result += fs.read(".ci/cirrus.release.yml")
-  if env.get("CIRRUS_CRON") == "monthly":
-    result += fs.read(".ci/cirrus.base.yml")
-    result += fs.read(".ci/cirrus.xcode.yml")
-  if env.get("CIRRUS_CRON") == "weekly":
-    result += fs.read(".ci/cirrus.runner.yml")
-  return result
@@ -1,21 +0,0 @@
-persistent_worker:
-  labels:
-    name: dev-mini
-  resources:
-    tart-vms: 1
-
-env:
-  TART_REGISTRY_HOSTNAME: ghcr.io
-  TART_REGISTRY_USERNAME: fkorotkov # GitHub supports only PATs
-  TART_REGISTRY_PASSWORD: ENCRYPTED[!82ed873afdf627284305afef4958c85a8f73127b09978a9786ac521559630ea6c9a5ab6e7f8315abf9ead09b6eff6eae!]
-  AWS_ACCESS_KEY_ID: ENCRYPTED[c187b670a17eead88c1698849376273991d09678efe37ae2f0c9738c27a2422741a71c501ef4b6a4df7bff3eca5213a9]
-  AWS_SECRET_ACCESS_KEY: ENCRYPTED[e456254a53b82e3167f2da23e24c389620cb3f7d47e4e5e7d993813bf9bb18c784d5cb8d88d19632073acc9e1f6096c9]
-
-defaults: &defaults
-  timeout_in: 3h
-  update_script:
-    - brew update || true
-    - brew upgrade || true
-  info_script:
-    - tart --version
-    - packer --version
@@ -0,0 +1,203 @@
+name: Monthly Images
+
+on:
+  schedule:
+    - cron: "0 8 * * 6"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  packages: write
+
+concurrency:
+  group: tart-image-builds
+  cancel-in-progress: false
+
+env:
+  TART_REGISTRY_HOSTNAME: ghcr.io
+  TART_REGISTRY_USERNAME: ${{ github.actor }}
+  TART_REGISTRY_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
+
+jobs:
+  should-run:
+    name: Check Monthly Cadence
+    runs-on: [self-hosted, macOS, ARM64]
+    outputs:
+      build: ${{ steps.cadence.outputs.build }}
+    steps:
+      - name: Check first Saturday
+        id: cadence
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+        run: |
+          set -euo pipefail
+
+          build=false
+          if [[ "$EVENT_NAME" == "workflow_dispatch" ]]; then
+            build=true
+          else
+            day="$(date -u +%d)"
+            if (( 10#$day <= 7 )); then
+              build=true
+            fi
+          fi
+
+          echo "build=$build" >> "$GITHUB_OUTPUT"
+          if [[ "$build" != "true" ]]; then
+            echo "Not the first Saturday of the month; skipping image rebuilds."
+          fi
+
+  update-base:
+    name: Update Base Images (${{ matrix.macos_version }})
+    needs: should-run
+    if: needs.should-run.outputs.build == 'true'
+    runs-on: [self-hosted, macOS, ARM64]
+    timeout-minutes: 180
+    strategy:
+      fail-fast: false
+      max-parallel: 1
+      matrix:
+        include:
+          - macos_version: sonoma
+            disable_sip_template: disable-sip.pkr.hcl
+          - macos_version: sequoia
+            disable_sip_template: disable-sip-with-username.pkr.hcl
+          - macos_version: tahoe
+            disable_sip_template: disable-sip-with-username.pkr.hcl
+    env:
+      MACOS_VERSION: ${{ matrix.macos_version }}
+      DISABLE_SIP_TEMPLATE: ${{ matrix.disable_sip_template }}
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Tool versions
+        run: |
+          tart --version
+          packer --version
+
+      - name: Pull vanilla image
+        run: |
+          tart pull "ghcr.io/cirruslabs/macos-$MACOS_VERSION-vanilla:latest"
+          tart clone "ghcr.io/cirruslabs/macos-$MACOS_VERSION-vanilla:latest" "$MACOS_VERSION-base"
+
+      - name: Disable SIP
+        run: |
+          packer init "templates/$DISABLE_SIP_TEMPLATE"
+          packer build -var "vm_name=$MACOS_VERSION-base" "templates/$DISABLE_SIP_TEMPLATE"
+
+      - name: Build base image
+        run: |
+          packer init templates/base.pkr.hcl
+          packer build -var "vm_name=$MACOS_VERSION-base" templates/base.pkr.hcl
+
+      - name: Push base image
+        run: |
+          tart push "$MACOS_VERSION-base" "ghcr.io/cirruslabs/macos-$MACOS_VERSION-base:latest"
+
+      - name: Cleanup
+        if: always()
+        run: |
+          tart delete "$MACOS_VERSION-base" || true
+
+  update-xcode:
+    name: Update Xcode Images (${{ matrix.macos_version }} ${{ matrix.xcode_version }})
+    needs:
+      - should-run
+      - update-base
+    if: needs.should-run.outputs.build == 'true'
+    runs-on: [self-hosted, macOS, ARM64]
+    timeout-minutes: 180
+    strategy:
+      fail-fast: false
+      max-parallel: 1
+      matrix:
+        include:
+          - macos_version: tahoe
+            xcode_version: "26.2"
+            xcode_components: '"MetalToolchain"'
+            latest: true
+          - macos_version: tahoe
+            xcode_version: "26.1.1"
+            xcode_components: '"MetalToolchain"'
+            latest: false
+          - macos_version: tahoe
+            xcode_version: "26.0.1"
+            xcode_components: '"MetalToolchain"'
+            latest: false
+          - macos_version: sequoia
+            xcode_version: "16.4"
+            xcode_components: ""
+            latest: true
+          - macos_version: sequoia
+            xcode_version: "16.3"
+            xcode_components: ""
+            latest: false
+          - macos_version: sequoia
+            xcode_version: "16.2"
+            xcode_components: ""
+            latest: false
+          - macos_version: sequoia
+            xcode_version: "16.1"
+            xcode_components: ""
+            latest: false
+          - macos_version: sequoia
+            xcode_version: "16"
+            xcode_components: ""
+            latest: false
+          - macos_version: sonoma
+            xcode_version: "16.1"
+            xcode_components: ""
+            latest: true
+          - macos_version: sonoma
+            xcode_version: "16"
+            xcode_components: ""
+            latest: false
+          - macos_version: sonoma
+            xcode_version: "15.4"
+            xcode_components: ""
+            latest: false
+    env:
+      MACOS_VERSION: ${{ matrix.macos_version }}
+      XCODE_COMPONENTS: ${{ matrix.xcode_components }}
+      XCODE_VERSION: ${{ matrix.xcode_version }}
+      LATEST: ${{ matrix.latest }}
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Tool versions
+        run: |
+          tart --version
+          packer --version
+
+      - name: Pull base image
+        run: |
+          tart pull "ghcr.io/cirruslabs/macos-$MACOS_VERSION-base:latest"
+
+      - name: Build Xcode image
+        run: |
+          packer init templates/xcode.pkr.hcl
+          packer build \
+            -var "macos_version=$MACOS_VERSION" \
+            -var "xcode_version=[\"$XCODE_VERSION\"]" \
+            -var "xcode_components=[$XCODE_COMPONENTS]" \
+            templates/xcode.pkr.hcl
+
+      - name: Push Xcode image
+        run: |
+          if [[ "$LATEST" == "true" ]]; then
+            tart push "$MACOS_VERSION-xcode:$XCODE_VERSION" \
+              "ghcr.io/cirruslabs/macos-$MACOS_VERSION-xcode:$XCODE_VERSION" \
+              "ghcr.io/cirruslabs/macos-$MACOS_VERSION-xcode:latest"
+          else
+            tart push "$MACOS_VERSION-xcode:$XCODE_VERSION" \
+              "ghcr.io/cirruslabs/macos-$MACOS_VERSION-xcode:$XCODE_VERSION"
+          fi
+
+      - name: Cleanup
+        if: always()
+        run: |
+          tart delete "$MACOS_VERSION-xcode:$XCODE_VERSION" || true
@@ -0,0 +1,167 @@
+name: Release Images
+
+on:
+  release:
+    types:
+      - published
+  workflow_dispatch:
+    inputs:
+      xcode_version:
+        description: "Xcode version/tag to release"
+        required: true
+        type: string
+
+permissions:
+  contents: read
+  packages: write
+
+concurrency:
+  group: tart-image-builds
+  cancel-in-progress: false
+
+env:
+  TART_REGISTRY_HOSTNAME: ghcr.io
+  TART_REGISTRY_USERNAME: ${{ github.actor }}
+  TART_REGISTRY_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
+  XCODE_RELEASE_VERSION: ${{ github.event.release.tag_name || inputs.xcode_version }}
+
+jobs:
+  release-xcode:
+    name: Release Xcode ${{ github.event.release.tag_name || inputs.xcode_version }} (${{ matrix.macos_version }})
+    runs-on: [self-hosted, macOS, ARM64]
+    timeout-minutes: 180
+    strategy:
+      fail-fast: false
+      max-parallel: 1
+      matrix:
+        macos_version:
+          - tahoe
+          - sequoia
+    env:
+      MACOS_VERSION: ${{ matrix.macos_version }}
+      XCODE_COMPONENTS: '"MetalToolchain"'
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Validate release version
+        run: |
+          set -euo pipefail
+          if [[ -z "$XCODE_RELEASE_VERSION" ]]; then
+            echo "XCODE_RELEASE_VERSION is required."
+            exit 1
+          fi
+
+      - name: Tool versions
+        run: |
+          tart --version
+          packer --version
+
+      - name: Pull base image
+        run: |
+          tart pull "ghcr.io/cirruslabs/macos-$MACOS_VERSION-base:latest"
+
+      - name: Build release image
+        run: |
+          packer init templates/xcode.pkr.hcl
+          packer build \
+            -var "macos_version=$MACOS_VERSION" \
+            -var "xcode_version=[\"$XCODE_RELEASE_VERSION\"]" \
+            -var "xcode_components=[$XCODE_COMPONENTS]" \
+            templates/xcode.pkr.hcl
+
+      - name: Push release image
+        run: |
+          if [[ "$XCODE_RELEASE_VERSION" == *beta* ]]; then
+            tart push "$MACOS_VERSION-xcode:$XCODE_RELEASE_VERSION" \
+              "ghcr.io/cirruslabs/macos-$MACOS_VERSION-xcode:$XCODE_RELEASE_VERSION"
+          else
+            tart push "$MACOS_VERSION-xcode:$XCODE_RELEASE_VERSION" \
+              "ghcr.io/cirruslabs/macos-$MACOS_VERSION-xcode:$XCODE_RELEASE_VERSION" \
+              "ghcr.io/cirruslabs/macos-$MACOS_VERSION-xcode:latest"
+          fi
+
+      - name: Cleanup
+        if: always()
+        run: |
+          tart delete "$MACOS_VERSION-xcode:$XCODE_RELEASE_VERSION" || true
+
+  release-runner:
+    name: Update Runner Image (${{ matrix.macos_version }})
+    # Keep runner refreshes independent from the release-xcode matrix so one
+    # Xcode image failure does not skip the runner matrix.
+    runs-on: [self-hosted, macOS, ARM64]
+    timeout-minutes: 180
+    strategy:
+      fail-fast: false
+      max-parallel: 1
+      matrix:
+        include:
+          - macos_version: sequoia
+            xcode_versions: '"26.0.1",16.4,16.3,16.2,16.1,16'
+            additional_ios_builds: "18.5,18.4,18.2,17.5"
+            additional_tvos_builds: "17.5"
+            xcode_components: '"MetalToolchain"'
+            disk_size: 380
+          - macos_version: tahoe
+            xcode_versions: '"26.6","27-beta-2","26.5","27-beta","26.4.1","26.3","26.2","26.1.1","26.0.1"'
+            additional_ios_builds: "18.6"
+            additional_tvos_builds: ""
+            xcode_components: '"MetalToolchain"'
+            disk_size: 520
+    env:
+      ADDITIONAL_IOS_BUILDS: ${{ matrix.additional_ios_builds }}
+      ADDITIONAL_TVOS_BUILDS: ${{ matrix.additional_tvos_builds }}
+      DISK_SIZE: ${{ matrix.disk_size }}
+      MACOS_VERSION: ${{ matrix.macos_version }}
+      XCODE_COMPONENTS: ${{ matrix.xcode_components }}
+      XCODE_VERSIONS: ${{ matrix.xcode_versions }}
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Tool versions
+        run: |
+          tart --version
+          packer --version
+
+      - name: Pull base image
+        run: |
+          tart pull "ghcr.io/cirruslabs/macos-$MACOS_VERSION-base:latest"
+
+      - name: Build runner image
+        run: |
+          packer init templates/xcode.pkr.hcl
+          packer build \
+            -var tag=runner \
+            -var "disk_size=$DISK_SIZE" \
+            -var disk_free_mb=100000 \
+            -var "macos_version=$MACOS_VERSION" \
+            -var "xcode_version=[$XCODE_VERSIONS]" \
+            -var "additional_ios_builds=[$ADDITIONAL_IOS_BUILDS]" \
+            -var "additional_tvos_builds=[$ADDITIONAL_TVOS_BUILDS]" \
+            -var "xcode_components=[$XCODE_COMPONENTS]" \
+            -var "expected_runtimes_file=data/expected.$MACOS_VERSION.runtimes.txt" \
+            templates/xcode.pkr.hcl
+
+      - name: Finalize runner image
+        run: |
+          if [[ -f "scripts/finalize-$MACOS_VERSION.sh" ]]; then
+            packer build \
+              -var "vm_name=$MACOS_VERSION-xcode:runner" \
+              -var "script_path=scripts/finalize-$MACOS_VERSION.sh" \
+              templates/exex-script.pkr.hcl
+          else
+            echo "Skipping prepare script for $MACOS_VERSION"
+          fi
+
+      - name: Push runner image
+        run: |
+          tart push "$MACOS_VERSION-xcode:runner" "ghcr.io/cirruslabs/macos-runner:$MACOS_VERSION"
+
+      - name: Cleanup
+        if: always()
+        run: |
+          tart delete "$MACOS_VERSION-xcode:runner" || true
@@ -0,0 +1,380 @@
+name: Template Builds
+
+on:
+  pull_request:
+    paths:
+      - ".github/workflows/monthly.yml"
+      - ".github/workflows/release.yml"
+      - ".github/workflows/template-validation.yml"
+      - "data/**"
+      - "scripts/**"
+      - "templates/**"
+
+permissions:
+  contents: read
+  packages: read
+
+concurrency:
+  group: template-builds-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+env:
+  FASTLANE_SESSION: ${{ secrets.FASTLANE_SESSION }}
+  FASTLANE_USER: ${{ secrets.FASTLANE_USER }}
+  HOMEBREW_NO_AUTO_UPDATE: 1
+  HOMEBREW_NO_INSTALL_CLEANUP: 1
+  PACKER_GITHUB_API_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+  TART_REGISTRY_HOSTNAME: ghcr.io
+  TART_REGISTRY_USERNAME: ${{ github.actor }}
+  TART_REGISTRY_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
+
+jobs:
+  packer-validate:
+    name: Packer Validate
+    runs-on: macos-15
+    timeout-minutes: 30
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Packer
+        uses: hashicorp/setup-packer@v3
+
+      - name: Install validation dependencies
+        run: |
+          brew install ansible
+
+      - name: Prepare validation inputs
+        run: |
+          mkdir -p "$HOME/XcodesCache"
+          touch "$HOME/XcodesCache/Xcode_26.6.xip"
+
+      - name: Validate templates
+        run: |
+          set -euo pipefail
+
+          validate() {
+            local template="$1"
+            shift
+
+            packer init "$template"
+            packer validate "$@" "$template"
+          }
+
+          for template in templates/vanilla-*.pkr.hcl; do
+            validate "$template"
+          done
+
+          validate templates/base.pkr.hcl \
+            -var vm_name=template-validation-base
+
+          validate templates/disable-sip.pkr.hcl \
+            -var vm_name=template-validation-disable-sip
+
+          validate templates/disable-sip-with-username.pkr.hcl \
+            -var vm_name=template-validation-disable-sip-user
+
+          validate templates/exex-script.pkr.hcl \
+            -var vm_name=template-validation-exec \
+            -var script_path=scripts/finalize-tahoe.sh
+
+          validate templates/resolve-macos-number.pkr.hcl \
+            -var vm_base_name=template-validation-base \
+            -var vm_name=template-validation-resolve \
+            -var resolve_file=macos-version.txt
+
+          validate templates/xcode.pkr.hcl \
+            -var macos_version=tahoe \
+            -var 'xcode_version=["26.6"]' \
+            -var expected_runtimes_file=data/expected.tahoe.runtimes.txt
+
+  build-vanilla:
+    name: Build Vanilla Image (${{ matrix.macos_version }})
+    needs: packer-validate
+    if: github.event.pull_request.head.repo.full_name == github.repository
+    runs-on: [self-hosted, macOS, ARM64]
+    timeout-minutes: 180
+    strategy:
+      fail-fast: false
+      max-parallel: 1
+      matrix:
+        macos_version:
+          - tahoe
+          - sequoia
+          - sonoma
+          - monterey
+    env:
+      MACOS_VERSION: ${{ matrix.macos_version }}
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Select image
+        id: select
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        run: |
+          set -euo pipefail
+
+          git diff --name-only "$BASE_SHA" "$HEAD_SHA" > changed-files.txt
+
+          build=false
+          if grep -Fxq "templates/vanilla-$MACOS_VERSION.pkr.hcl" changed-files.txt; then
+            build=true
+          fi
+
+          echo "build=$build" >> "$GITHUB_OUTPUT"
+
+      - name: Tool versions
+        if: steps.select.outputs.build == 'true'
+        run: |
+          tart --version
+          packer --version
+
+      - name: Build vanilla image
+        if: steps.select.outputs.build == 'true'
+        run: |
+          packer init "templates/vanilla-$MACOS_VERSION.pkr.hcl"
+          packer build "templates/vanilla-$MACOS_VERSION.pkr.hcl"
+
+      - name: Cleanup
+        if: always() && steps.select.outputs.build == 'true'
+        run: |
+          tart delete "$MACOS_VERSION-vanilla" || true
+
+  build-base:
+    name: Build Base Image (${{ matrix.macos_version }})
+    needs: packer-validate
+    if: github.event.pull_request.head.repo.full_name == github.repository
+    runs-on: [self-hosted, macOS, ARM64]
+    timeout-minutes: 180
+    strategy:
+      fail-fast: false
+      max-parallel: 1
+      matrix:
+        include:
+          - macos_version: sonoma
+            disable_sip_template: disable-sip.pkr.hcl
+          - macos_version: sequoia
+            disable_sip_template: disable-sip-with-username.pkr.hcl
+          - macos_version: tahoe
+            disable_sip_template: disable-sip-with-username.pkr.hcl
+    env:
+      DISABLE_SIP_TEMPLATE: ${{ matrix.disable_sip_template }}
+      MACOS_VERSION: ${{ matrix.macos_version }}
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Select image
+        id: select
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        run: |
+          set -euo pipefail
+
+          git diff --name-only "$BASE_SHA" "$HEAD_SHA" > changed-files.txt
+
+          build=false
+          if grep -Eq '^(templates/base\.pkr\.hcl|templates/disable-sip.*\.pkr\.hcl|data/(github_known_hosts|limit\.maxfiles\.plist|setup-info-template\.json|tart-guest-.*\.plist)|scripts/(install-actions-runner|update-tcc-database)\.sh|ansible/)' changed-files.txt; then
+            build=true
+          fi
+
+          echo "build=$build" >> "$GITHUB_OUTPUT"
+
+      - name: Tool versions
+        if: steps.select.outputs.build == 'true'
+        run: |
+          tart --version
+          packer --version
+
+      - name: Pull vanilla image
+        if: steps.select.outputs.build == 'true'
+        run: |
+          tart pull "ghcr.io/cirruslabs/macos-$MACOS_VERSION-vanilla:latest"
+          tart clone "ghcr.io/cirruslabs/macos-$MACOS_VERSION-vanilla:latest" "$MACOS_VERSION-base"
+
+      - name: Disable SIP
+        if: steps.select.outputs.build == 'true'
+        run: |
+          packer init "templates/$DISABLE_SIP_TEMPLATE"
+          packer build -var "vm_name=$MACOS_VERSION-base" "templates/$DISABLE_SIP_TEMPLATE"
+
+      - name: Build base image
+        if: steps.select.outputs.build == 'true'
+        run: |
+          packer init templates/base.pkr.hcl
+          packer build -var "vm_name=$MACOS_VERSION-base" templates/base.pkr.hcl
+
+      - name: Cleanup
+        if: always() && steps.select.outputs.build == 'true'
+        run: |
+          tart delete "$MACOS_VERSION-base" || true
+
+  build-runner:
+    name: Build Runner Image (${{ matrix.macos_version }})
+    needs: packer-validate
+    if: github.event.pull_request.head.repo.full_name == github.repository
+    runs-on: [self-hosted, macOS, ARM64]
+    timeout-minutes: 180
+    strategy:
+      fail-fast: false
+      max-parallel: 1
+      matrix:
+        include:
+          - macos_version: tahoe
+            xcode_versions: '"26.6","27-beta-2","26.5","27-beta","26.4.1","26.3","26.2","26.1.1","26.0.1"'
+            additional_ios_builds: "18.6"
+            additional_tvos_builds: ""
+            xcode_components: '"MetalToolchain"'
+            disk_size: 520
+          - macos_version: sequoia
+            xcode_versions: '"26.0.1",16.4,16.3,16.2,16.1,16'
+            additional_ios_builds: "18.5,18.4,18.2,17.5"
+            additional_tvos_builds: "17.5"
+            xcode_components: '"MetalToolchain"'
+            disk_size: 380
+    env:
+      ADDITIONAL_IOS_BUILDS: ${{ matrix.additional_ios_builds }}
+      ADDITIONAL_TVOS_BUILDS: ${{ matrix.additional_tvos_builds }}
+      DISK_SIZE: ${{ matrix.disk_size }}
+      MACOS_VERSION: ${{ matrix.macos_version }}
+      XCODE_COMPONENTS: ${{ matrix.xcode_components }}
+      XCODE_VERSIONS: ${{ matrix.xcode_versions }}
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Select image
+        id: select
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        run: |
+          set -euo pipefail
+
+          git diff --name-only "$BASE_SHA" "$HEAD_SHA" > changed-files.txt
+
+          build=false
+          if grep -Fxq ".github/workflows/release.yml" changed-files.txt; then
+            build=true
+          elif grep -Fxq "data/expected.$MACOS_VERSION.runtimes.txt" changed-files.txt; then
+            build=true
+          elif grep -Fxq "scripts/finalize-$MACOS_VERSION.sh" changed-files.txt; then
+            build=true
+          elif grep -Eq '^(templates/xcode\.pkr\.hcl|data/setup-info-template\.json|scripts/install-actions-runner\.sh)$' changed-files.txt; then
+            build=true
+          fi
+
+          echo "build=$build" >> "$GITHUB_OUTPUT"
+
+      - name: Tool versions
+        if: steps.select.outputs.build == 'true'
+        run: |
+          tart --version
+          packer --version
+
+      - name: Pull base image
+        if: steps.select.outputs.build == 'true'
+        run: |
+          tart pull "ghcr.io/cirruslabs/macos-$MACOS_VERSION-base:latest"
+
+      - name: Prepare Xcode archives
+        if: steps.select.outputs.build == 'true'
+        run: |
+          set -euo pipefail
+
+          source ~/.zprofile || true
+
+          if ! command -v xcodes >/dev/null; then
+            brew install xcodes
+          fi
+
+          mkdir -p "$HOME/XcodesCache"
+          IFS=',' read -ra versions <<< "$XCODE_VERSIONS"
+
+          for raw_version in "${versions[@]}"; do
+            version="${raw_version//\"/}"
+            target="$HOME/XcodesCache/Xcode_${version}.xip"
+
+            if [[ -f "$target" ]]; then
+              echo "Using cached Xcode $version at $target"
+              continue
+            fi
+
+            echo "Downloading Xcode $version"
+            if [[ -z "${FASTLANE_SESSION:-}" ]]; then
+              echo "::error::Missing $target and FASTLANE_SESSION is not configured. Pre-cache the Xcode archive on the runner or add Apple Developer auth secrets."
+              exit 1
+            fi
+
+            download_args=(download "$version" --directory "$HOME/XcodesCache" --use-fastlane-auth)
+            if [[ -n "${FASTLANE_USER:-}" ]]; then
+              download_args+=(--fastlane-user "$FASTLANE_USER")
+            fi
+            xcodes "${download_args[@]}"
+
+            candidate=""
+            case "$version" in
+              27-beta-2)
+                candidate="$HOME/XcodesCache/Xcode_27_beta_2.xip"
+                ;;
+              27-beta)
+                candidate="$HOME/XcodesCache/Xcode_27_beta.xip"
+                ;;
+              *)
+                candidate="$(find "$HOME/XcodesCache" -maxdepth 1 -type f -name "Xcode_${version}*.xip" -print -quit)"
+                ;;
+            esac
+
+            if [[ -n "$candidate" && -f "$candidate" && "$candidate" != "$target" ]]; then
+              mv "$candidate" "$target"
+            fi
+
+            test -f "$target"
+          done
+
+      - name: Build runner image
+        if: steps.select.outputs.build == 'true'
+        run: |
+          packer init templates/xcode.pkr.hcl
+          packer build \
+            -var tag=runner \
+            -var "disk_size=$DISK_SIZE" \
+            -var disk_free_mb=100000 \
+            -var "macos_version=$MACOS_VERSION" \
+            -var "xcode_version=[$XCODE_VERSIONS]" \
+            -var "additional_ios_builds=[$ADDITIONAL_IOS_BUILDS]" \
+            -var "additional_tvos_builds=[$ADDITIONAL_TVOS_BUILDS]" \
+            -var "xcode_components=[$XCODE_COMPONENTS]" \
+            -var "expected_runtimes_file=data/expected.$MACOS_VERSION.runtimes.txt" \
+            templates/xcode.pkr.hcl
+
+      - name: Finalize runner image
+        if: steps.select.outputs.build == 'true'
+        run: |
+          if [[ -f "scripts/finalize-$MACOS_VERSION.sh" ]]; then
+            packer build \
+              -var "vm_name=$MACOS_VERSION-xcode:runner" \
+              -var "script_path=scripts/finalize-$MACOS_VERSION.sh" \
+              templates/exex-script.pkr.hcl
+          else
+            echo "Skipping prepare script for $MACOS_VERSION"
+          fi
+
+      - name: Cleanup
+        if: always() && steps.select.outputs.build == 'true'
+        run: |
+          tart delete "$MACOS_VERSION-xcode:runner" || true
@@ -0,0 +1,127 @@
+name: Vanilla Images
+
+on:
+  push:
+    paths:
+      - "templates/vanilla-*.pkr.hcl"
+  workflow_dispatch:
+    inputs:
+      macos_version:
+        description: "macOS vanilla image to build"
+        required: true
+        default: all
+        type: choice
+        options:
+          - all
+          - tahoe
+          - sequoia
+          - sonoma
+          - monterey
+
+permissions:
+  contents: read
+  packages: write
+
+concurrency:
+  group: tart-image-builds
+  cancel-in-progress: false
+
+env:
+  TART_REGISTRY_HOSTNAME: ghcr.io
+  TART_REGISTRY_USERNAME: ${{ github.actor }}
+  TART_REGISTRY_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
+
+jobs:
+  update-vanilla:
+    name: Update Vanilla Image (${{ matrix.macos_version }})
+    if: >-
+      ${{
+        github.event_name == 'workflow_dispatch' ||
+        github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
+      }}
+    runs-on: [self-hosted, macOS, ARM64]
+    timeout-minutes: 180
+    strategy:
+      fail-fast: false
+      max-parallel: 1
+      matrix:
+        macos_version:
+          - tahoe
+          - sequoia
+          - sonoma
+          - monterey
+    env:
+      MACOS_VERSION: ${{ matrix.macos_version }}
+      RESOLVE_VM_NAME: resolve-macos-number-${{ github.run_id }}-${{ github.run_attempt }}-${{ matrix.macos_version }}
+      RESOLVE_FILE: resolve-macos-number-${{ github.run_id }}-${{ github.run_attempt }}-${{ matrix.macos_version }}.txt
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Select image
+        id: select
+        env:
+          BEFORE_SHA: ${{ github.event.before }}
+          EVENT_NAME: ${{ github.event_name }}
+          INPUT_MACOS_VERSION: ${{ inputs.macos_version || 'all' }}
+        run: |
+          set -euo pipefail
+
+          build=false
+          if [[ "$EVENT_NAME" == "workflow_dispatch" ]]; then
+            if [[ "$INPUT_MACOS_VERSION" == "all" || "$INPUT_MACOS_VERSION" == "$MACOS_VERSION" ]]; then
+              build=true
+            fi
+          else
+            if [[ "$BEFORE_SHA" =~ ^0+$ ]]; then
+              git diff-tree --no-commit-id --name-only -r "$GITHUB_SHA" > changed-files.txt
+            else
+              git diff --name-only "$BEFORE_SHA" "$GITHUB_SHA" > changed-files.txt
+            fi
+
+            if grep -Fxq "templates/vanilla-$MACOS_VERSION.pkr.hcl" changed-files.txt; then
+              build=true
+            fi
+          fi
+
+          echo "build=$build" >> "$GITHUB_OUTPUT"
+
+      - name: Tool versions
+        if: steps.select.outputs.build == 'true'
+        run: |
+          tart --version
+          packer --version
+
+      - name: Build vanilla image
+        if: steps.select.outputs.build == 'true'
+        run: |
+          packer init "templates/vanilla-$MACOS_VERSION.pkr.hcl"
+          packer build "templates/vanilla-$MACOS_VERSION.pkr.hcl"
+
+      - name: Resolve macOS version
+        id: resolve
+        if: steps.select.outputs.build == 'true'
+        run: |
+          packer build \
+            -var "vm_base_name=$MACOS_VERSION-vanilla" \
+            -var "vm_name=$RESOLVE_VM_NAME" \
+            -var "resolve_file=$RESOLVE_FILE" \
+            templates/resolve-macos-number.pkr.hcl
+          echo "macos_number=$(cat "$RESOLVE_FILE")" >> "$GITHUB_OUTPUT"
+          rm -f "$RESOLVE_FILE"
+
+      - name: Push vanilla image
+        if: steps.select.outputs.build == 'true'
+        run: |
+          tart push "$MACOS_VERSION-vanilla" \
+            "ghcr.io/cirruslabs/macos-$MACOS_VERSION-vanilla:latest" \
+            "ghcr.io/cirruslabs/macos-$MACOS_VERSION-vanilla:${{ steps.resolve.outputs.macos_number }}"
+
+      - name: Cleanup
+        if: always() && steps.select.outputs.build == 'true'
+        run: |
+          tart delete "$MACOS_VERSION-vanilla" || true
+          tart delete "$RESOLVE_VM_NAME" || true
@@ -15,7 +15,7 @@ packer build -var vm_name=sonoma-vanilla templates/disable-sip.pkr.hcl
 ## Building Base Image

 ```bash
-packer build -var macos_version=sonoma templates/base.pkr.hcl
+packer build -var vm_name=sonoma-vanilla templates/base.pkr.hcl
 ```

 ## Building Xcode Image
@@ -1,32 +1,25 @@
 ## macOS Packer Templates for Tart

-Repository with Packer templates to build macOS [Tart](https://tart.run/) virtual machines to use with [Cirrus Runners](https://cirrus-runners.app/),
-[Cirrus CI](https://cirrus-ci.org/guide/macOS/) or [any other automation](https://tart.run/integrations/cirrus-cli/).
+Repository with Packer templates to build macOS [Tart](https://tart.run/) virtual machines to use with self-hosted
+GitHub Actions runners, [Cirrus Runners](https://cirrus-runners.app/) or [any other automation](https://tart.run/integrations/cirrus-cli/).

 The following image variants are currently available:

-* `macos-{sequoia,sonoma}-base` image has only `brew` pre-installed and the latest version of `macOS` available
-* `macos-{sequoia,sonoma}-xcode:N` image is based on `macos-{sequoia,sonoma}-base` image and has `Xcode N` with [`Flutter`](https://flutter.dev/) pre-installed
-* `macos-runner:{sequoia,sonoma}` image is a variant of `xcode:N` with several versions of `Xcode` pre-installed and [`xcodes` tool](https://github.com/XcodesOrg/xcodes) to switch between them.
+* `macos-{tahoe,sequoia,sonoma}-vanilla` — a vanilla macOS installation with helpful tweaks such as auto-login, but no additional software preinstalled
+* `macos-{tahoe,sequoia,sonoma}-base` — based on `macos-{tahoe,sequoia,sonoma}-vanilla` image, it comes with `brew` and [other useful software](https://github.com/cirruslabs/macos-image-templates/blob/main/templates/base.pkr.hcl) pre-installed, but without Xcode
+* `macos-{tahoe,sequoia,sonoma}-xcode:N` — based on `macos-{tahoe,sequoia,sonoma}-base` image and has `Xcode N` with [`Flutter`](https://flutter.dev/) pre-installed
+* `macos-runner:{tahoe,sequoia,sonoma}` — a variant of `xcode:N` with several versions of `Xcode` pre-installed and [`xcodes` tool](https://github.com/XcodesOrg/xcodes) to switch between them.

 See a full list of VMs available [here](https://github.com/orgs/cirruslabs/packages?tab=packages&q=macos-).

 ## Release Cadence

 Once a new version of Xcode is released, we will initiate a GitHub release which will automatically build and push
-a new version of the `macos-sequoia-xcode:N`. This generally happens within 24 hours of a release.
+a new version of the `macos-{tahoe,sequoia}-xcode:N`. This generally happens the next weekend after a release.
 Please watch this repository releases to get notified about new images.

-For an Xcode release which is non beta and not an RC `ghcr.io/cirruslabs/macos-runner:sequoia` image will also be updated.
-
 ## Update Cadence

-Some of the images are regularly getting rebuild in order to update the pre-installed packages. The following images are updated
-monthly on the first Saturday of the month:
+Some of the images are regularly getting rebuild in order to update the pre-installed packages. 

-* `ghcr.io/cirruslabs/macos-{sequoia,sonoma}-base`
-* `ghcr.io/cirruslabs/macos-runner:sonoma` which is a superset of `ghcr.io/cirruslabs/macos-sonoma-xcode:{latest,16.1,16,15.4,15.3,15.2,15.1,15.0.1}`
-* `ghcr.io/cirruslabs/macos-runner:sequoia` which is a superset of `ghcr.io/cirruslabs/macos-sequoia-xcode:{latest,16.2,16.1,16,15.4}`
-
-Note that `ghcr.io/cirruslabs/macos-runner:{sequoia,sonoma}` are updated every Sunday and these images are [optimised for startup](https://cirrus-runners.app/blog/2024/04/11/optimizing-startup-time-of-cirrus-runners/)
-on Cirrus Runners and Cirrus CI services.
+[This workflow](.github/workflows/monthly.yml) defines images that are getting rebuilt monthly on the first Saturday of the month.
@@ -15,7 +15,7 @@
 # otherwise on the OS update the "softwareupdate" will be stuck at "Downloaded: macOS [...]"
 - name: install available update
  command:
-    cmd: "softwareupdate --install --agree-to-license --force --restart --user admin --stdinpass {{ stdinpass }} '{{ item.label }}'"
+    cmd: "softwareupdate --install --agree-to-license --force --restart --user admin --stdinpass {{ stdinpass | default('') }} '{{ item.label }}'"
    stdin: "{{ ansible_password }}"
  register: update_result
  # Work around the following:
@@ -24,8 +24,10 @@
  # > ssh: connect to host [...] port 22: Connection refused.
  ignore_unreachable: yes
  # Ignore SIGTERM/SIGKILL sent "softwareupdate" process
-  # when the system reboots due to --restart
-  failed_when: update_result.rc not in [0, 9, -9, 15, -15]
+  # when the system reboots due to --restart and any other errors,
+  # since we'll check whether the update was installed in main.yml
+  # anyway.
+  ignore_errors: yes
  become: yes
  loop: "{{ software_updates }}"
  when: "not item.label.startswith('macOS') or item.version.split('.')[0] == ansible_facts['distribution_version'].split('.')[0]"
@@ -38,6 +40,4 @@
    # the commands below on a non-restarted system.
    delay: 60
    timeout: 1800
-  when:
-    - update_result is defined
-    - not update_result.skipped
+  when: update_result is defined and not update_result.skipped | default(false)
@@ -0,0 +1,20 @@
+== Runtimes ==
+iOS 17.5 (17.5 - 21F79) - com.apple.CoreSimulator.SimRuntime.iOS-17-5
+iOS 18.0 (18.0 - 22A3351) - com.apple.CoreSimulator.SimRuntime.iOS-18-0
+iOS 18.1 (18.1 - 22B81) - com.apple.CoreSimulator.SimRuntime.iOS-18-1
+iOS 18.2 (18.2 - 22C150) - com.apple.CoreSimulator.SimRuntime.iOS-18-2
+iOS 18.3 (18.3.1 - 22D8075) - com.apple.CoreSimulator.SimRuntime.iOS-18-3
+iOS 18.4 (18.4 - 22E238) - com.apple.CoreSimulator.SimRuntime.iOS-18-4
+iOS 18.5 (18.5 - 22F77) - com.apple.CoreSimulator.SimRuntime.iOS-18-5
+iOS 18.6 (18.6 - 22G86) - com.apple.CoreSimulator.SimRuntime.iOS-18-6
+iOS 26.0 (26.0.1 - 23A8464) - com.apple.CoreSimulator.SimRuntime.iOS-26-0
+tvOS 17.5 (17.5 - 21L569) - com.apple.CoreSimulator.SimRuntime.tvOS-17-5
+tvOS 18.4 (18.4 - 22L254) - com.apple.CoreSimulator.SimRuntime.tvOS-18-4
+tvOS 18.5 (18.5 - 22L572) - com.apple.CoreSimulator.SimRuntime.tvOS-18-5
+tvOS 26.0 (26.0 - 23J352) - com.apple.CoreSimulator.SimRuntime.tvOS-26-0
+watchOS 11.4 (11.4 - 22T250) - com.apple.CoreSimulator.SimRuntime.watchOS-11-4
+watchOS 11.5 (11.5 - 22T572) - com.apple.CoreSimulator.SimRuntime.watchOS-11-5
+watchOS 26.0 (26.0 - 23R353) - com.apple.CoreSimulator.SimRuntime.watchOS-26-0
+visionOS 2.4 (2.4 - 22O237) - com.apple.CoreSimulator.SimRuntime.xrOS-2-4
+visionOS 2.5 (2.5 - 22O473) - com.apple.CoreSimulator.SimRuntime.xrOS-2-5
+visionOS 26.0 (26.0 - 23M336) - com.apple.CoreSimulator.SimRuntime.xrOS-26-0
@@ -0,0 +1,9 @@
+== Runtimes ==
+iOS 18.0 (18.0 - 22A3351) - com.apple.CoreSimulator.SimRuntime.iOS-18-0
+iOS 18.1 (18.1 - 22B81) - com.apple.CoreSimulator.SimRuntime.iOS-18-1
+tvOS 18.0 (18.0 - 22J356) - com.apple.CoreSimulator.SimRuntime.tvOS-18-0
+tvOS 18.1 (18.1 - 22J578) - com.apple.CoreSimulator.SimRuntime.tvOS-18-1
+watchOS 11.0 (11.0 - 22R349) - com.apple.CoreSimulator.SimRuntime.watchOS-11-0
+watchOS 11.1 (11.1 - 22R581) - com.apple.CoreSimulator.SimRuntime.watchOS-11-1
+visionOS 2.0 (2.0 - 22N318) - com.apple.CoreSimulator.SimRuntime.xrOS-2-0
+visionOS 2.1 (2.1 - 22N580) - com.apple.CoreSimulator.SimRuntime.xrOS-2-1
@@ -0,0 +1,15 @@
+== Runtimes ==
+iOS 18.6 (18.6 - 22G86) - com.apple.CoreSimulator.SimRuntime.iOS-18-6
+iOS 26.0 (26.0.1 - 23A8464) - com.apple.CoreSimulator.SimRuntime.iOS-26-0
+iOS 26.1 (26.1 - 23B86) - com.apple.CoreSimulator.SimRuntime.iOS-26-1
+iOS 26.3 (26.3.1 - 23D8133) - com.apple.CoreSimulator.SimRuntime.iOS-26-3
+iOS 26.4 (26.4.1 - 23E254a) - com.apple.CoreSimulator.SimRuntime.iOS-26-4
+iOS 26.5 (26.5 - 23F77) - com.apple.CoreSimulator.SimRuntime.iOS-26-5
+iOS 27.0 (27.0 - 24A5355p) - com.apple.CoreSimulator.SimRuntime.iOS-27-0
+iOS 27.0 (27.0 - 24A5370g) - com.apple.CoreSimulator.SimRuntime.iOS-27-0
+tvOS 26.5 (26.5 - 23L470) - com.apple.CoreSimulator.SimRuntime.tvOS-26-5
+tvOS 27.0 (27.0 - 24J5305f) - com.apple.CoreSimulator.SimRuntime.tvOS-27-0
+watchOS 26.5 (26.5 - 23T570) - com.apple.CoreSimulator.SimRuntime.watchOS-26-5
+watchOS 27.0 (27.0 - 24R5305f) - com.apple.CoreSimulator.SimRuntime.watchOS-27-0
+visionOS 26.5 (26.5 - 23O470) - com.apple.CoreSimulator.SimRuntime.xrOS-26-5
+visionOS 27.0 (27.0 - 24M5306g) - com.apple.CoreSimulator.SimRuntime.xrOS-27-0
@@ -0,0 +1,52 @@
+[
+  {
+    "group": "Runner Detail",
+    "detail": [
+      {
+        "name": "OS Information",
+        "script": "echo \"macOS $(sw_vers -productVersion) ($(sw_vers -buildVersion))\""
+      },
+      {
+        "name": "Build Date",
+        "script": "date +\"%Y-%m-%d\""
+      }
+    ]
+  },
+  {
+    "group": "Software Detail",
+    "detail": [
+      {
+        "name": "Xcode Versions",
+        "script": "xcodes installed --no-color || echo \"Xcode not installed\""
+      },
+      {
+        "name": "Python Version",
+        "script": "python3 --version"
+      },
+      {
+        "name": "Node Version",
+        "script": "node --version"
+      },
+      {
+        "name": "Ruby Version",
+        "script": "ruby --version"
+      },
+      {
+        "name": "Bundler Version",
+        "script": "bundler --version"
+      },
+      {
+        "name": "CocoaPods Version",
+        "script": "pod --version"
+      },
+      {
+        "name": "Fastlane Version",
+        "script": "fastlane --version"
+      },
+      {
+        "name": "SwiftLint Version",
+        "script": "swiftlint --version"
+      }
+    ]
+  }
+]
@@ -0,0 +1,30 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+    <dict>
+        <key>Label</key>
+        <string>org.cirruslabs.tart-guest-agent</string>
+        <key>ProgramArguments</key>
+        <array>
+            <string>/opt/homebrew/bin/tart-guest-agent</string>
+            <string>--run-agent</string>
+        </array>
+        <key>EnvironmentVariables</key>
+        <dict>
+            <key>PATH</key>
+            <string>/bin:/usr/bin:/usr/sbin:/usr/local/bin:/opt/homebrew/bin</string>
+            <key>TERM</key>
+            <string>xterm-256color</string>
+        </dict>
+        <key>WorkingDirectory</key>
+        <string>/Users/admin</string>
+        <key>RunAtLoad</key>
+        <true/>
+        <key>KeepAlive</key>
+        <true/>
+        <key>StandardOutPath</key>
+        <string>/tmp/tart-guest-agent.log</string>
+        <key>StandardErrorPath</key>
+        <string>/tmp/tart-guest-agent.log</string>
+    </dict>
+</plist>
@@ -0,0 +1,28 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+    <dict>
+        <key>Label</key>
+        <string>org.cirruslabs.tart-guest-daemon</string>
+        <key>ProgramArguments</key>
+        <array>
+            <string>/opt/homebrew/bin/tart-guest-agent</string>
+            <string>--run-daemon</string>
+        </array>
+        <key>EnvironmentVariables</key>
+        <dict>
+            <key>PATH</key>
+            <string>/bin:/usr/bin:/usr/sbin:/usr/local/bin:/opt/homebrew/bin</string>
+        </dict>
+        <key>WorkingDirectory</key>
+        <string>/var/empty</string>
+        <key>RunAtLoad</key>
+        <true/>
+        <key>KeepAlive</key>
+        <true/>
+        <key>StandardOutPath</key>
+        <string>/tmp/tart-guest-daemon.log</string>
+        <key>StandardErrorPath</key>
+        <string>/tmp/tart-guest-daemon.log</string>
+    </dict>
+</plist>
@@ -0,0 +1,72 @@
+#!/bin/bash
+
+source ~/.zprofile
+
+# Set shell options to enable fail-fast behavior
+#
+# * -e: fail the script when an error occurs or command fails
+# * -u: fail the script when attempting to reference unset parameters
+# * -o pipefail: by default an exit status of a pipeline is that of its
+#                last command, this fails the pipe early if an error in
+#                any of its commands occurs
+#
+set -euo pipefail
+
+# Wait until `xcrun simctl list devices -v` no longer reports any devices as "unavailable".
+#
+# Exit codes:
+#   0 - Success: no devices are marked as unavailable within the timeout window
+#   1 - Failure: timed out waiting for devices to become available
+#   2 - Failure: prerequisites missing (e.g., xcrun not found)
+
+DEFAULT_TIMEOUT_MINUTES=60
+TIMEOUT_MINUTES=${1:-$DEFAULT_TIMEOUT_MINUTES}
+
+if ! [[ "$TIMEOUT_MINUTES" =~ ^[0-9]+$ ]]; then
+  echo "[wait-simulators] ERROR: TIMEOUT_MINUTES must be an integer number of minutes (got: '$TIMEOUT_MINUTES')." >&2
+  exit 2
+fi
+
+SECONDS_TOTAL=$(( TIMEOUT_MINUTES * 60 ))
+DEADLINE=$(( $(date +%s) + SECONDS_TOTAL ))
+SLEEP_SECONDS=15
+
+# Print a one-line status snapshot of current unavailable devices (if any)
+print_status() {
+  if xcrun simctl list devices -v | grep -qi "unavailable"; then
+    echo "[wait-simulators] Still seeing 'unavailable' devices at $(date '+%Y-%m-%d %H:%M:%S')"
+    # Show a concise list of unavailable lines for debugging
+    xcrun simctl list devices -v | grep -i "unavailable" | sed 's/^/[wait-simulators]   /'
+  else
+    echo "[wait-simulators] No 'unavailable' devices detected at $(date '+%Y-%m-%d %H:%M:%S')"
+  fi
+}
+
+trap 'echo "[wait-simulators] Interrupted" >&2; exit 130' INT TERM
+
+echo "[wait-simulators] Waiting up to ${TIMEOUT_MINUTES} minute(s) for simulators to become available..."
+
+while true; do
+  if ! xcrun simctl list devices -v | grep -qi "unavailable"; then
+    echo "[wait-simulators] All simulators are available."
+    exit 0
+  fi
+
+  NOW=$(date +%s)
+  if (( NOW >= DEADLINE )); then
+    echo "[wait-simulators] TIMEOUT after ${TIMEOUT_MINUTES} minute(s). Some simulators remain 'unavailable'." >&2
+    echo "[wait-simulators] Final snapshot of unavailable devices:" >&2
+    xcrun simctl list devices -v | grep -i "unavailable" | sed 's/^/[wait-simulators]   /' >&2
+    exit 1
+  fi
+
+  print_status
+  REMAIN=$(( DEADLINE - NOW ))
+  # Sleep in chunks to allow quicker exit when they become available
+  SLEEP=$SLEEP_SECONDS
+  if (( REMAIN < SLEEP_SECONDS )); then SLEEP=$REMAIN; fi
+  sleep "$SLEEP"
+  # Loop and re-check
+done
+
+
@@ -0,0 +1,55 @@
+#!/bin/bash
+
+source ~/.zprofile
+
+# Set shell options to enable fail-fast behavior
+#
+# * -e: fail the script when an error occurs or command fails
+# * -u: fail the script when attempting to reference unset parameters
+# * -o pipefail: by default an exit status of a pipeline is that of its
+#                last command, this fails the pipe early if an error in
+#                any of its commands occurs
+#
+set -euo pipefail
+
+update_tcc_database() {
+  sudo sqlite3 "$1" <<-'EOF'
+	INSERT OR REPLACE
+	INTO access (
+	  service,
+	  client_type,
+	  client,
+	  auth_value,
+	  auth_reason,
+	  auth_version,
+	  indirect_object_identifier_type,
+	  indirect_object_identifier
+	) VALUES
+	-- Indirect osascript invocation via SSH
+	('kTCCServiceAccessibility', 1, '/usr/libexec/sshd-keygen-wrapper', 2, 0, 1, NULL, 'UNUSED'),
+	('kTCCServiceScreenCapture', 1, '/usr/libexec/sshd-keygen-wrapper', 2, 0, 1, NULL, 'UNUSED'),
+	('kTCCServicePostEvent', 1, '/usr/libexec/sshd-keygen-wrapper', 2, 0, 1, NULL, 'UNUSED'),
+	('kTCCServiceAppleEvents', 1, '/usr/libexec/sshd-keygen-wrapper', 2, 0, 1, 0, 'com.apple.systemevents'),
+	('kTCCServiceAppleEvents', 1, '/usr/libexec/sshd-keygen-wrapper', 2, 0, 1, 0, 'com.apple.Safari'),
+	-- Direct osascript invocation
+	('kTCCServiceAccessibility', 1, '/usr/bin/osascript', 2, 0, 1, NULL, 'UNUSED'),
+	('kTCCServiceScreenCapture', 1, '/usr/bin/osascript', 2, 0, 1, NULL, 'UNUSED'),
+	('kTCCServicePostEvent', 1, '/usr/bin/osascript', 2, 0, 1, NULL, 'UNUSED'),
+	('kTCCServiceAppleEvents', 1, '/usr/bin/osascript', 2, 0, 1, 0, 'com.apple.systemevents'),
+	('kTCCServiceAppleEvents', 1, '/usr/bin/osascript', 2, 0, 1, 0, 'com.apple.Safari'),
+	-- Direct Python invocation
+	('kTCCServiceAccessibility', 0, 'org.python.python', 2, 0, 1, NULL, 'UNUSED'),
+	('kTCCServiceScreenCapture', 0, 'org.python.python', 2, 0, 1, NULL, 'UNUSED'),
+	('kTCCServicePostEvent', 0, 'org.python.python', 2, 0, 1, NULL, 'UNUSED'),
+	-- Commands invoked through the Tart Guest Agent
+	('kTCCServiceAccessibility', 1, '/opt/homebrew/bin/tart-guest-agent', 2, 0, 1, NULL, 'UNUSED'),
+	('kTCCServiceScreenCapture', 1, '/opt/homebrew/bin/tart-guest-agent', 2, 0, 1, NULL, 'UNUSED'),
+	('kTCCServicePostEvent', 1, '/opt/homebrew/bin/tart-guest-agent', 2, 0, 1, NULL, 'UNUSED');
+	EOF
+}
+
+# Update TCC.db for all users
+update_tcc_database "/Library/Application Support/com.apple.TCC/TCC.db"
+
+# Update TCC.db for the current user
+update_tcc_database "${HOME}/Library/Application Support/com.apple.TCC/TCC.db"
@@ -7,13 +7,12 @@ packer {
  }
 }

-variable "macos_version" {
+variable "vm_name" {
  type = string
 }

 source "tart-cli" "tart" {
-  vm_base_name = "ghcr.io/cirruslabs/macos-${var.macos_version}-vanilla:latest"
-  vm_name      = "${var.macos_version}-base"
+  vm_name      = "${var.vm_name}"
  cpu_count    = 4
  memory_gb    = 8
  disk_size_gb = 50
@@ -65,6 +64,8 @@ build {
      "brew --version",
      "brew update",
      "brew install wget unzip zip ca-certificates cmake gcc git-lfs jq yq gh gitlab-runner",
+      "brew install buildkite/buildkite/buildkite-agent@3",
+      "brew install equinix-labs/otel-cli/otel-cli",
      "brew install curl || true", // doesn't work on Monterey
      "brew install --cask git-credential-manager",
      "git lfs install",
@@ -105,6 +106,7 @@ build {
      "brew install libyaml", # https://github.com/rbenv/ruby-build/discussions/2118
      "brew install rbenv",
      "echo 'if which rbenv > /dev/null; then eval \"$(rbenv init -)\"; fi' >> ~/.zprofile",
+      "brew install mise",
      "source ~/.zprofile",
      "rbenv install 2.7.8", // latest 2.x.x before EOL
      "rbenv install -l | grep -v - | tail -2 | xargs -L1 rbenv install",
@@ -115,8 +117,8 @@ build {
  provisioner "shell" {
    inline = [
      "source ~/.zprofile",
-      "brew install node@20",
-      "echo 'export PATH=\"/opt/homebrew/opt/node@20/bin:$PATH\"' >> ~/.zprofile",
+      "brew install node@24",
+      "echo 'export PATH=\"/opt/homebrew/opt/node@24/bin:$PATH\"' >> ~/.zprofile",
      "source ~/.zprofile",
      "node --version",
      "npm install --global yarn",
@@ -145,8 +147,39 @@ build {
    inline = [
      "source ~/.zprofile",
      "test -d /Users/runner",
-      "test -f ~/.ssh/known_hosts",
-      "brew doctor"
+      "test -f ~/.ssh/known_hosts"
    ]
  }
+
+  // Guest agent for Tart VMs
+  provisioner "file" {
+    source      = "data/tart-guest-daemon.plist"
+    destination = "~/tart-guest-daemon.plist"
+  }
+  provisioner "file" {
+    source      = "data/tart-guest-agent.plist"
+    destination = "~/tart-guest-agent.plist"
+  }
+  provisioner "shell" {
+    inline = [
+      # Install Tart Guest Agent
+      "source ~/.zprofile",
+      "brew install cirruslabs/cli/tart-guest-agent",
+
+      # Install daemon variant of the Tart Guest Agent
+      "sudo mv ~/tart-guest-daemon.plist /Library/LaunchDaemons/org.cirruslabs.tart-guest-daemon.plist",
+      "sudo chown root:wheel /Library/LaunchDaemons/org.cirruslabs.tart-guest-daemon.plist",
+      "sudo chmod 0644 /Library/LaunchDaemons/org.cirruslabs.tart-guest-daemon.plist",
+
+      # Install agent variant of the Tart Guest Agent
+      "sudo mv ~/tart-guest-agent.plist /Library/LaunchAgents/org.cirruslabs.tart-guest-agent.plist",
+      "sudo chown root:wheel /Library/LaunchAgents/org.cirruslabs.tart-guest-agent.plist",
+      "sudo chmod 0644 /Library/LaunchAgents/org.cirruslabs.tart-guest-agent.plist",
+    ]
+  }
+
+  # Update TCC.db and allow automation tools
+  provisioner "shell" {
+    script = "scripts/update-tcc-database.sh"
+  }
 }
@@ -0,0 +1,39 @@
+packer {
+  required_plugins {
+    tart = {
+      version = ">= 1.12.0"
+      source  = "github.com/cirruslabs/tart"
+    }
+  }
+}
+
+variable "vm_name" {
+  type = string
+}
+
+source "tart-cli" "tart" {
+  vm_name      = "${var.vm_name}"
+  recovery     = true
+  cpu_count    = 4
+  memory_gb    = 8
+  disk_size_gb = 50
+  communicator = "none"
+  boot_command = [
+    # Skip over "Macintosh" and select "Options"
+    # to boot into macOS Recovery
+    "<wait60s><right><right><enter>",
+    # Open Terminal
+    "<wait10s><leftAltOn>T<leftAltOff>",
+    # Disable SIP
+    "<wait10s>csrutil disable<enter>",
+    "<wait10s>y<enter>",
+    "<wait10s>admin<enter>",
+    "<wait10s>admin<enter>",
+    # Shutdown
+    "<wait10s>halt<enter>"
+  ]
+}
+
+build {
+  sources = ["source.tart-cli.tart"]
+}
@@ -0,0 +1,39 @@
+packer {
+  required_plugins {
+    tart = {
+      version = ">= 1.12.0"
+      source  = "github.com/cirruslabs/tart"
+    }
+  }
+}
+
+variable "vm_name" {
+  type = string
+}
+
+variable "script_path" {
+  type        = string
+  description = "Path to a local script that should be uploaded and executed inside the VM."
+}
+
+variable "pause_before" {
+  type        = string
+  default     = "60s"
+  description = "How long Packer should wait before running the uploaded script."
+}
+
+source "tart-cli" "tart" {
+  vm_name      = "${var.vm_name}"
+  ssh_password = "admin"
+  ssh_username = "admin"
+  ssh_timeout  = "120s"
+}
+
+build {
+  sources = ["source.tart-cli.tart"]
+
+  provisioner "shell" {
+    script = var.script_path
+    pause_before = var.pause_before
+  }
+}
@@ -34,7 +34,9 @@ build {

  provisioner "shell" {
    inline = [
-      "sw_vers --productVersion > /tmp/sw-vers-product-version.txt",
+      # Use "-productVersion" instead of "--productVersion"
+      # to support old-style syntax used on macOS Monterey
+      "sw_vers -productVersion > /tmp/sw-vers-product-version.txt",
    ]
  }

@@ -17,7 +17,7 @@ source "tart-cli" "tart" {
  vm_name      = "monterey-vanilla"
  cpu_count    = 4
  memory_gb    = 8
-  disk_size_gb = 40
+  disk_size_gb = 50
  ssh_password = "admin"
  ssh_username = "admin"
  ssh_timeout  = "120s"
@@ -136,6 +136,7 @@ build {
  provisioner "ansible" {
    playbook_file = "ansible/playbook-system-updater.yml"
    extra_arguments = [
+      "-vvv",
      "--extra-vars", "stdinpass=admin",
    ]
    ansible_env_vars = [
@@ -1,7 +1,7 @@
 packer {
  required_plugins {
    tart = {
-      version = ">= 1.12.0"
+      version = ">= 1.16.0"
      source  = "github.com/cirruslabs/tart"
    }
    ansible = {
@@ -12,14 +12,15 @@ packer {
 }

 source "tart-cli" "tart" {
-  from_ipsw    = "https://updates.cdn-apple.com/2025WinterFCS/fullrestores/072-08269/7CAAB9F7-E970-428D-8764-4CD7BCD105CD/UniversalMac_15.3_24D60_Restore.ipsw"
+  // will be update to 15.7.2
+  from_ipsw    = "https://updates.cdn-apple.com/2025SummerFCS/fullrestores/093-10809/CFD6DD38-DAF0-40DA-854F-31AAD1294C6F/UniversalMac_15.6.1_24G90_Restore.ipsw"
  vm_name      = "sequoia-vanilla"
  cpu_count    = 4
  memory_gb    = 8
-  disk_size_gb = 40
+  disk_size_gb = 50
  ssh_password = "admin"
  ssh_username = "admin"
-  ssh_timeout  = "300s"
+  ssh_timeout  = "180s"
  boot_command = [
    # hello, hola, bonjour, etc.
    "<wait60s><spacebar>",
@@ -31,28 +32,30 @@ source "tart-cli" "tart" {
    #
    # [1]: should be named "English (US)", but oh well 🤷
    "<wait30s>italiano<esc>english<enter>",
-    # Select Your Country and Region
-    "<wait30s>united states<leftShiftOn><tab><leftShiftOff><spacebar>",
+    # Select Your Country or Region
+    "<wait30s><click 'Select Your Country or Region'><wait5s>united states<leftShiftOn><tab><leftShiftOff><spacebar>",
+    # Transfer Your Data to This Mac
+    "<wait10s><tab><tab><tab><spacebar><tab><tab><spacebar>",
    # Written and Spoken Languages
    "<wait10s><leftShiftOn><tab><leftShiftOff><spacebar>",
    # Accessibility
    "<wait10s><leftShiftOn><tab><leftShiftOff><spacebar>",
    # Data & Privacy
    "<wait10s><leftShiftOn><tab><leftShiftOff><spacebar>",
-    # Migration Assistant
-    "<wait10s><tab><tab><tab><spacebar>",
+    # Create a Mac Account
+    "<wait10s>Managed via Tart<tab>admin<tab>admin<tab>admin<tab><tab><spacebar><tab><tab><spacebar>",
+    # Enable Voice Over
+    "<wait120s><leftAltOn><f5><leftAltOff>",
    # Sign In with Your Apple ID
-    "<wait10s><leftShiftOn><tab><leftShiftOff><leftShiftOn><tab><leftShiftOff><spacebar>",
+    "<wait10s><leftShiftOn><tab><leftShiftOff><spacebar>",
    # Are you sure you want to skip signing in with an Apple ID?
    "<wait10s><tab><spacebar>",
    # Terms and Conditions
    "<wait10s><leftShiftOn><tab><leftShiftOff><spacebar>",
    # I have read and agree to the macOS Software License Agreement
    "<wait10s><tab><spacebar>",
-    # Create a Computer Account
-    "<wait10s>admin<tab><tab>admin<tab>admin<tab><tab><tab><spacebar>",
    # Enable Location Services
-    "<wait120s><leftShiftOn><tab><leftShiftOff><spacebar>",
+    "<wait10s><leftShiftOn><tab><leftShiftOff><spacebar>",
    # Are you sure you don't want to use Location Services?
    "<wait10s><tab><spacebar>",
    # Select Your Time Zone
@@ -65,8 +68,12 @@ source "tart-cli" "tart" {
    "<wait10s><tab><spacebar><leftShiftOn><tab><leftShiftOff><spacebar>",
    # Choose Your Look
    "<wait10s><leftShiftOn><tab><leftShiftOff><spacebar>",
+    # Update Mac Automatically
+    "<wait10s><tab><spacebar>",
    # Welcome to Mac
    "<wait10s><spacebar>",
+    # Disable Voice Over
+    "<leftAltOn><f5><leftAltOff>",
    # Enable Keyboard navigation
    # This is so that we can navigate the System Settings app using the keyboard
    "<wait10s><leftAltOn><spacebar><leftAltOff>Terminal<enter>",
@@ -75,13 +82,27 @@ source "tart-cli" "tart" {
    # Now that the installation is done, open "System Settings"
    "<wait10s><leftAltOn><spacebar><leftAltOff>System Settings<enter>",
    # Navigate to "Sharing"
-    "<wait10s><leftAltOn>f<leftAltOff>sharing<enter>",
+    "<wait10s><leftCtrlOn><f2><leftCtrlOff><right><right><right><down>Sharing<enter>",
    # Navigate to "Screen Sharing" and enable it
-    "<wait10s><tab><tab><tab><tab><tab><spacebar>",
+    "<wait10s><tab><tab><tab><tab><tab><tab><tab><spacebar>",
    # Navigate to "Remote Login" and enable it
    "<wait10s><tab><tab><tab><tab><tab><tab><tab><tab><tab><tab><tab><tab><spacebar>",
    # Quit System Settings
    "<wait10s><leftAltOn>q<leftAltOff>",
+    # Disable Gatekeeper (1/2)
+    "<wait10s><leftAltOn><spacebar><leftAltOff>Terminal<enter>",
+    "<wait10s>sudo spctl --global-disable<enter>",
+    "<wait10s>admin<enter>",
+    "<wait10s><leftAltOn>q<leftAltOff>",
+    # Disable Gatekeeper (2/2)
+    "<wait10s><leftAltOn><spacebar><leftAltOff>System Settings<enter>",
+    "<wait10s><leftCtrlOn><f2><leftCtrlOff><right><right><right><down>Privacy & Security<enter>",
+    "<wait10s><leftShiftOn><tab><leftShiftOff><leftShiftOn><tab><leftShiftOff><leftShiftOn><tab><leftShiftOff><leftShiftOn><tab><leftShiftOff><leftShiftOn><tab><leftShiftOff><leftShiftOn><tab><leftShiftOff><leftShiftOn><tab><leftShiftOff>",
+    "<wait10s><down><wait1s><down><wait1s><enter>",
+    "<wait10s>admin<enter>",
+    "<wait10s><leftShiftOn><tab><leftShiftOff><wait1s><spacebar>",
+    # Quit System Settings
+    "<wait10s><leftAltOn>q<leftAltOff>",
  ]

  // A (hopefully) temporary workaround for Virtualization.Framework's
@@ -126,6 +147,13 @@ build {
    ]
  }

+  provisioner "shell" {
+    inline = [
+      # Ensure that Gatekeeper is disabled
+      "spctl --status | grep -q 'assessments disabled'"
+    ]
+  }
+
  provisioner "shell" {
    inline = [
      # Install command-line tools
@@ -137,6 +165,9 @@ build {

  provisioner "ansible" {
    playbook_file = "ansible/playbook-system-updater.yml"
+    extra_arguments = [
+      "-vvv",
+    ]
    ansible_env_vars = [
      "ANSIBLE_TRANSPORT=paramiko",
      "ANSIBLE_HOST_KEY_CHECKING=False",
@@ -12,14 +12,15 @@ packer {
 }

 source "tart-cli" "tart" {
-  from_ipsw    = "https://updates.cdn-apple.com/2024SummerFCS/fullrestores/052-69922/F5DA2B64-25EB-4370-9E89-FA5689859796/UniversalMac_14.6_23G80_Restore.ipsw"
+  // will be update to 14.8.2
+  from_ipsw    = "https://updates.cdn-apple.com/2024SummerFCS/fullrestores/062-52859/932E0A8F-6644-4759-82DA-F8FA8DEA806A/UniversalMac_14.6.1_23G93_Restore.ipsw"
  vm_name      = "sonoma-vanilla"
  cpu_count    = 4
  memory_gb    = 8
-  disk_size_gb = 40
+  disk_size_gb = 50
  ssh_password = "admin"
  ssh_username = "admin"
-  ssh_timeout  = "120s"
+  ssh_timeout  = "180s"
  boot_command = [
    # hello, hola, bonjour, etc.
    "<wait60s><spacebar>",
@@ -134,6 +135,9 @@ build {

  provisioner "ansible" {
    playbook_file = "ansible/playbook-system-updater.yml"
+    extra_arguments = [
+      "-vvv",
+    ]
    ansible_env_vars = [
      "ANSIBLE_TRANSPORT=paramiko",
      "ANSIBLE_HOST_KEY_CHECKING=False",
@@ -0,0 +1,163 @@
+packer {
+  required_plugins {
+    tart = {
+      version = ">= 1.16.0"
+      source  = "github.com/cirruslabs/tart"
+    }
+    ansible = {
+      version = "~> 1"
+      source  = "github.com/hashicorp/ansible"
+    }
+  }
+}
+
+source "tart-cli" "tart" {
+  from_ipsw    = "https://updates.cdn-apple.com/2026SummerFCS/fullrestores/140-83079/25315EF6-AEAB-4588-9774-A3723774C47F/UniversalMac_26.6.1_25G76_Restore.ipsw"
+  vm_name      = "tahoe-vanilla"
+  cpu_count    = 4
+  memory_gb    = 8
+  disk_size_gb = 50
+  ssh_password = "admin"
+  ssh_username = "admin"
+  ssh_timeout  = "180s"
+  boot_command = [
+    # hello, hola, bonjour, etc.
+    "<wait60s><spacebar>",
+    # Language: most of the times we have a list of "English"[1], "English (UK)", etc. with
+    # "English" language already selected. If we type "english", it'll cause us to switch
+    # to the "English (UK)", which is not what we want. To solve this, we switch to some other
+    # language first, e.g. "Italiano" and then switch back to "English". We'll then jump to the
+    # first entry in a list of "english"-prefixed items, which will be "English".
+    #
+    # [1]: should be named "English (US)", but oh well 🤷
+    "<wait30s>italiano<esc>english<enter>",
+    # Select Your Country or Region
+    "<wait60s><click 'Select Your Country or Region'><wait5s>united states<leftShiftOn><tab><leftShiftOff><spacebar>",
+    # Transfer Your Data to This Mac
+    "<wait10s><tab><tab><tab><spacebar><tab><tab><spacebar>",
+    # Written and Spoken Languages
+    "<wait10s><leftShiftOn><tab><leftShiftOff><spacebar>",
+    # Accessibility
+    "<wait10s><leftShiftOn><tab><leftShiftOff><spacebar>",
+    # Data & Privacy
+    "<wait10s><leftShiftOn><tab><leftShiftOff><spacebar>",
+    # Create a Mac Account
+    "<wait10s><tab><tab><tab><tab><tab><tab>Managed via Tart<tab>admin<tab>admin<tab>admin<tab><tab><spacebar><tab><tab><spacebar>",
+    # Enable Voice Over
+    "<wait120s><leftAltOn><f5><leftAltOff>",
+    # Sign In with Your Apple ID
+    "<wait10s><leftShiftOn><tab><leftShiftOff><spacebar><up><spacebar>",
+    # Are you sure you want to skip signing in with an Apple ID?
+    "<wait10s><tab><spacebar>",
+    # Terms and Conditions
+    "<wait10s><leftShiftOn><tab><leftShiftOff><spacebar>",
+    # I have read and agree to the macOS Software License Agreement
+    "<wait10s><tab><spacebar>",
+    # Age Range -> Adult
+    "<wait10s><tab><tab><tab><spacebar>",
+    # Enable Location Services
+    "<wait10s><leftShiftOn><tab><leftShiftOff><spacebar>",
+    # Are you sure you don't want to use Location Services?
+    "<wait10s><tab><spacebar>",
+    # Select Your Time Zone
+    "<wait10s><tab><tab><tab>UTC<enter><leftShiftOn><tab><leftShiftOff><spacebar>",
+    # Analytics
+    "<wait10s><leftShiftOn><tab><leftShiftOff><spacebar>",
+    # Screen Time
+    "<wait10s><tab><tab><spacebar>",
+    # Siri
+    "<wait10s><tab><spacebar><leftShiftOn><tab><leftShiftOff><spacebar>",
+    # You Mac is Ready for FileVault
+    "<wait10s><leftShiftOn><tab><tab><leftShiftOff><spacebar>",
+    # Mac Data Will Not Be Securely Encrypted
+    "<wait10s><tab><spacebar>",
+    # Choose Your Look
+    "<wait10s><leftShiftOn><tab><leftShiftOff><spacebar>",
+    # Update Mac Automatically
+    "<wait10s><tab><tab><spacebar>",
+    # Welcome to Mac
+    "<wait30s><spacebar>",
+    # Disable Voice Over
+    "<wait10s><leftAltOn><f5><leftAltOff>",
+    # Enable Keyboard navigation
+    # This is so that we can navigate the System Settings app using the keyboard
+    "<wait10s><leftAltOn><spacebar><leftAltOff>Terminal<wait10s><enter>",
+    "<wait10s><wait10s>defaults write NSGlobalDomain AppleKeyboardUIMode -int 3<enter>",
+    # Now that the installation is done, open "System Settings"
+    # On Tahoe opening System Settings through Spotlight is not very reliable, sometimes opens System information
+    "<wait10s>open '/System/Applications/System Settings.app'<enter>",
+    "<wait120s>",
+    # Navigate to "Sharing"
+    "<wait10s><leftCtrlOn><f2><leftCtrlOff><right><right><right><down>Sharing<enter>",
+    # Navigate to "Screen Sharing" and enable it
+    "<wait10s><tab><tab><tab><tab><tab><spacebar>",
+    # Type in the password to allow enabling Screen Sharing
+    "<wait10s>admin<enter>",
+    # Navigate to "Remote Login" and enable it
+    "<wait10s><tab><tab><tab><tab><tab><tab><tab><tab><tab><tab><tab><tab><spacebar>",
+    # Quit System Settings
+    "<wait10s><leftAltOn>q<leftAltOff>",
+    # Disable Gatekeeper (1/2)
+    "<wait10s>sudo spctl --global-disable<enter>",
+    "<wait10s>admin<enter>",
+    # Disable Gatekeeper (2/2)
+    # On Tahoe opening System Settings through Spotlight is not very reliable, sometimes opens System information
+    "<wait10s>open '/System/Applications/System Settings.app'<enter>",
+    "<wait10s><leftCtrlOn><f2><leftCtrlOff><right><right><right><down>Privacy & Security<enter>",
+    "<wait10s><leftShiftOn><tab><tab><tab><tab><tab><tab><leftShiftOff>",
+    "<wait10s><down><wait1s><down><wait1s><enter>",
+    "<wait10s>admin<enter>",
+    "<wait10s><leftShiftOn><tab><leftShiftOff><wait1s><spacebar>",
+    # Quit System Settings
+    "<wait10s><leftAltOn>q<leftAltOff>",
+  ]
+
+  // A (hopefully) temporary workaround for Virtualization.Framework's
+  // installation process not fully finishing in a timely manner
+  create_grace_time = "30s"
+
+  // Keep the recovery partition, otherwise it's not possible to "softwareupdate"
+  recovery_partition = "keep"
+}
+
+build {
+  sources = ["source.tart-cli.tart"]
+
+  provisioner "shell" {
+    inline = [
+      // Enable passwordless sudo
+      "echo admin | sudo -S sh -c \"mkdir -p /etc/sudoers.d/; echo 'admin ALL=(ALL) NOPASSWD: ALL' | EDITOR=tee visudo /etc/sudoers.d/admin-nopasswd\"",
+      // Enable auto-login
+      //
+      // See https://github.com/xfreebird/kcpassword for details.
+      "echo '00000000: 1ced 3f4a bcbc ba2c caca 4e82' | sudo xxd -r - /etc/kcpassword",
+      "sudo defaults write /Library/Preferences/com.apple.loginwindow autoLoginUser admin",
+      // Disable screensaver at login screen
+      "sudo defaults write /Library/Preferences/com.apple.screensaver loginWindowIdleTime 0",
+      // Disable screensaver for admin user
+      "defaults -currentHost write com.apple.screensaver idleTime 0",
+      // Prevent the VM from sleeping
+      "sudo systemsetup -setsleep Off 2>/dev/null",
+      // Launch Safari to populate the defaults
+      "/Applications/Safari.app/Contents/MacOS/Safari &",
+      "SAFARI_PID=$!",
+      "disown",
+      "sleep 30",
+      "kill -9 $SAFARI_PID",
+      // Enable Safari's remote automation
+      "sudo safaridriver --enable",
+      // Disable screen lock
+      //
+      // Note that this only works if the user is logged-in,
+      // i.e. not on login screen.
+      "sysadminctl -screenLock off -password admin",
+    ]
+  }
+
+  provisioner "shell" {
+    inline = [
+      # Ensure that Gatekeeper is disabled
+      "spctl --status | grep -q 'assessments disabled'"
+    ]
+  }
+}
@@ -18,7 +18,7 @@ source "tart-cli" "tart" {
  vm_name      = "ventura-vanilla"
  cpu_count    = 4
  memory_gb    = 8
-  disk_size_gb = 40
+  disk_size_gb = 50
  ssh_password = "admin"
  ssh_username = "admin"
  ssh_timeout  = "120s"
@@ -143,6 +143,9 @@ build {

  provisioner "ansible" {
    playbook_file = "ansible/playbook-system-updater.yml"
+    extra_arguments = [
+      "-vvv",
+    ]
    ansible_env_vars = [
      "ANSIBLE_TRANSPORT=paramiko",
      "ANSIBLE_HOST_KEY_CHECKING=False",
@@ -15,29 +15,46 @@ variable "xcode_version" {
  type = list(string)
 }

-variable "additional_runtimes" {
-  type = list(string)
+variable "additional_ios_builds" {
+  type    = list(string)
  default = []
 }

+variable "additional_tvos_builds" {
+  type    = list(string)
+  default = []
+}
+
+variable "xcode_components" {
+  type        = list(string)
+  default     = []
+  description = "Additional Xcode components to download."
+}
+
+variable "expected_runtimes_file" {
+  type        = string
+  default     = ""
+  description = "Path to file containing expected simulator runtimes. If empty, runtime verification is skipped."
+}
+
 variable "tag" {
-  type = string
+  type    = string
  default = ""
 }

 variable "disk_size" {
-  type = number
-  default = 100
+  type    = number
+  default = 140
 }

 variable "disk_free_mb" {
-  type = number
+  type    = number
  default = 15000
 }

 variable "android_sdk_tools_version" {
  type    = string
-  default = "11076708" # https://developer.android.com/studio#command-line-tools-only
+  default = "14742923" # https://developer.android.com/studio#command-line-tools-only
 }

 source "tart-cli" "tart" {
@@ -66,8 +83,9 @@ locals {
        "APP_DIR=$(dirname $CONTENTS_DIR)",
        "sudo mv $APP_DIR /Applications/Xcode_${version}.app",
        "sudo xcode-select -s /Applications/Xcode_${version}.app",
-        "xcodebuild -downloadAllPlatforms",
+        "xcodebuild -downloadPlatform iOS",
        "xcodebuild -runFirstLaunch",
+        "df -h",
      ]
    }
  ]
@@ -82,6 +100,9 @@ build {
      "brew --version",
      "brew update",
      "brew upgrade",
+      "brew install codex",
+      "brew install --cask claude-code",
+      "brew install --cask amazon-q"
    ]
  }

@@ -112,37 +133,69 @@ build {
      "rm android-sdk-tools.zip",
      "mv $ANDROID_HOME/cmdline-tools/cmdline-tools $ANDROID_HOME/cmdline-tools/latest",
      "yes | sdkmanager --licenses",
-      "yes | sdkmanager 'platform-tools' 'platforms;android-35' 'build-tools;35.0.0' 'ndk;27.2.12479018'"
+      "yes | sdkmanager 'platform-tools' 'platforms;android-36' 'build-tools;36.0.0' 'ndk;28.2.13676358'"
    ]
  }

  provisioner "shell" {
    inline = [
      "source ~/.zprofile",
-      "brew install xcodesorg/made/xcodes",
+      "brew install xcodes",
      "xcodes version",
    ]
  }

  provisioner "file" {
-    sources      = [ for version in var.xcode_version : pathexpand("~/XcodesCache/Xcode_${version}.xip")]
+    sources     = [for version in var.xcode_version : pathexpand("~/XcodesCache/Xcode_${version}.xip")]
    destination = "/Users/admin/Downloads/"
  }

+  provisioner "shell" {
+    inline = [
+      "source ~/.zprofile",
+      "df -h",
+    ]
+  }
+
  // iterate over all Xcode versions and install them
  // select the latest one as the default
  dynamic "provisioner" {
    for_each = local.xcode_install_provisioners
-    labels = ["shell"]
+    labels   = ["shell"]
    content {
      inline = provisioner.value.inline
    }
  }

+  dynamic "provisioner" {
+    for_each = length(var.xcode_version) > 2 ? [2] : []
+    labels   = ["shell"]
+    content {
+      inline = [
+        "source ~/.zprofile",
+        "sudo xcode-select -s /Applications/Xcode_${var.xcode_version[2]}.app/Contents/Developer",
+        "xcodebuild -downloadAllPlatforms",
+      ]
+    }
+  }
+
+  dynamic "provisioner" {
+    for_each = length(var.xcode_version) > 1 ? [1] : []
+    labels   = ["shell"]
+    content {
+      inline = [
+        "source ~/.zprofile",
+        "sudo xcode-select -s /Applications/Xcode_${var.xcode_version[1]}.app/Contents/Developer",
+        "xcodebuild -downloadAllPlatforms",
+      ]
+    }
+  }
+
  provisioner "shell" {
    inline = [
      "source ~/.zprofile",
-      "sudo xcodes select '${var.xcode_version[0]}'",
+      "sudo xcode-select -s /Applications/Xcode_${var.xcode_version[0]}.app/Contents/Developer",
+      "xcodebuild -downloadAllPlatforms",
    ]
  }

@@ -150,11 +203,72 @@ build {
    inline = concat(
      ["source ~/.zprofile"],
      [
-        for runtime in var.additional_runtimes : "sudo xcodes runtimes install ${runtime}"
+        for runtime in var.additional_ios_builds : "xcodebuild -downloadPlatform iOS -buildVersion ${runtime}"
      ]
    )
  }

+  provisioner "shell" {
+    inline = concat(
+      ["source ~/.zprofile"],
+      [
+        for runtime in var.additional_tvos_builds : "xcodebuild -downloadPlatform tvOS -buildVersion ${runtime}"
+      ]
+    )
+  }
+
+  provisioner "shell" {
+    inline = concat(
+      ["source ~/.zprofile"],
+      [
+        for component in var.xcode_components : "xcodebuild -downloadComponent ${component}"
+      ]
+    )
+  }
+
+  provisioner "shell" {
+    inline = [
+      "source ~/.zprofile",
+      "brew install libimobiledevice ideviceinstaller ios-deploy carthage",
+      "brew install xcbeautify swiftformat swiftlint swiftgen licenseplist",
+      "brew install mint",
+      "git clone --depth 1 https://github.com/tuist/homebrew-tuist.git \"$(brew --repository)/Library/Taps/tuist/homebrew-tuist\"",
+      "rm -rf \"$(brew --repository)/Library/Taps/tuist/homebrew-tuist/Casks\"",
+      "tuist_version=$(ruby -ne 'if $_ =~ %r{/download/([^/]+)/}; puts $1; exit; end' \"$(brew --repository)/Library/Taps/tuist/homebrew-tuist/Aliases/tuist\") && brew trust --formula \"tuist/tuist/tuist@$tuist_version\" && brew install --formula \"tuist/tuist/tuist@$tuist_version\"",
+      "rbenv install 3.3.10",
+      "rbenv global 3.3.10", # fastlane conflicts with 3.4.0+ https://github.com/fastlane/fastlane/issues/29527
+      "gem update",
+      "gem install fastlane",
+      "gem install cocoapods",
+      "gem install xcpretty",
+      "gem uninstall --ignore-dependencies ffi && gem install ffi -- --enable-libffi-alloc"
+    ]
+  }
+
+  // Copy expected runtimes file if provided
+  dynamic "provisioner" {
+    for_each = var.expected_runtimes_file != "" ? [1] : []
+    labels   = ["file"]
+    content {
+      source      = var.expected_runtimes_file
+      destination = "/Users/admin/runtimes.expected.txt"
+    }
+  }
+
+  // Verify simulator runtimes match expected list if file was provided
+  dynamic "provisioner" {
+    for_each = var.expected_runtimes_file != "" ? [1] : []
+    labels   = ["shell"]
+    content {
+      inline = [
+        "source ~/.zprofile",
+        "xcrun simctl list runtimes > /Users/admin/runtimes.actual.txt",
+        "diff -q /Users/admin/runtimes.actual.txt /Users/admin/runtimes.expected.txt || (echo 'Simulator runtimes do not match expected list' && cat /Users/admin/runtimes.actual.txt && exit 1)",
+        "rm /Users/admin/runtimes.actual.txt /Users/admin/runtimes.expected.txt"
+      ]
+    }
+  }
+
  provisioner "shell" {
    inline = [
      "source ~/.zprofile",
@@ -169,17 +283,6 @@ build {
      "flutter precache",
    ]
  }
-  provisioner "shell" {
-    inline = [
-      "source ~/.zprofile",
-      "brew install libimobiledevice ideviceinstaller ios-deploy fastlane carthage",
-      "brew install xcbeautify",
-      "gem update",
-      "gem install cocoapods",
-      "gem install xcpretty",
-      "gem uninstall --ignore-dependencies ffi && gem install ffi -- --enable-libffi-alloc"
-    ]
-  }

  # useful utils for mobile development
  provisioner "shell" {
@@ -240,6 +343,19 @@ build {
    ]
  }

+  # Wait for the "update_dyld_sim_shared_cache" process[1][2] to finish
+  # to avoid wasting CPU cycles after boot
+  #
+  # [1]: https://apple.stackexchange.com/questions/412101/update-dyld-sim-shared-cache-is-taking-up-a-lot-of-memory
+  # [2]: https://stackoverflow.com/a/68394101/9316533
+  provisioner "shell" {
+    inline = [
+      "source ~/.zprofile",
+      "xcrun simctl runtime dyld_shared_cache update --all || sleep 180",
+      "xcrun simctl list -v"
+    ]
+  }
+
  # Compatibility with GitHub Actions Runner Images, where
  # /usr/local/bin belongs to the default user. Also see [2].
  #
@@ -251,14 +367,26 @@ build {
    ]
  }

-  # Wait for the "update_dyld_sim_shared_cache" process[1][2] to finish
-  # to avoid wasting CPU cycles after boot
-  #
-  # [1]: https://apple.stackexchange.com/questions/412101/update-dyld-sim-shared-cache-is-taking-up-a-lot-of-memory
-  # [2]: https://stackoverflow.com/a/68394101/9316533
+  // Install setup-info-generator
  provisioner "shell" {
    inline = [
-      "sleep 1800"
+      "source ~/.zprofile",
+      "brew install cirruslabs/cli/setup-info-generator"
+    ]
+  }
+
+  // Copy setup info template
+  provisioner "file" {
+    source      = "data/setup-info-template.json"
+    destination = "~/setup-info-template.json"
+  }
+
+  // Generate setup info
+  provisioner "shell" {
+    inline = [
+      "source ~/.zprofile",
+      "cat ~/setup-info-template.json | setup-info-generator > ~/actions-runner/.setup_info",
+      "rm ~/setup-info-template.json"
    ]
  }
 }