feat: add optional no-SIP image variant to update-vm-tools workflow

.github/workflows/update-vm-tools.yml

@@ -11,6 +11,11 @@ on:
         description: 'Comma-separated list of images to update (e.g., sequoia,sonoma). Leave blank to update all.'
         required: false
         default: ''
+      noSip:
+        description: 'Also build a no-SIP variant of each image'
+        required: false
+        default: false
+        type: boolean
 
 permissions:
   contents: read
@@ -73,6 +78,8 @@ jobs:
         run: |
           echo "VM_NAME=vm-tools-updater-${{ github.run_id }}-${{ matrix.name }}-${{ matrix.tag }}" >> "$GITHUB_OUTPUT"
           echo "TEMP_NAME=vm-tools-updated-${{ github.run_id }}-${{ matrix.name }}-${{ matrix.tag }}" >> "$GITHUB_OUTPUT"
+          echo "NOSIP_VM_NAME=vm-tools-nosip-${{ github.run_id }}-${{ matrix.name }}-${{ matrix.tag }}" >> "$GITHUB_OUTPUT"
+          echo "NOSIP_TEMP_NAME=vm-tools-nosip-updated-${{ github.run_id }}-${{ matrix.name }}-${{ matrix.tag }}" >> "$GITHUB_OUTPUT"
 
       - name: Pull image
         if: env.SKIP_IMAGE != 'true'
@@ -83,22 +90,58 @@ jobs:
       - name: Run VM
         if: env.SKIP_IMAGE != 'true'
         run: |
-          orka-engine vm run ${{ steps.vars.outputs.VM_NAME }} \
+          # launchctl asuser runs orka-engine inside the runner's GUI login session,
+          # which RunVZ requires for LaunchServices access on macOS 15.
+          sudo launchctl asuser "$(id -u)" /usr/local/bin/orka-engine vm run ${{ steps.vars.outputs.VM_NAME }} \
             --image ghcr.io/macstadium/orka-images/${{ matrix.name }}:${{ matrix.source_tag }} \
+            --disable-graphical-console \
             -d
 
       - name: Wait for VM IP
         if: env.SKIP_IMAGE != 'true'
-        timeout-minutes: 5
+        timeout-minutes: 10
         id: vm-ip
         run: |
+          vm_name="${{ steps.vars.outputs.VM_NAME }}"
           output=""
+          itr=0
           while [ -z "$output" ]; do
-            output=$(orka-engine vm list ${{ steps.vars.outputs.VM_NAME }} -o json | jq -r '.[0].ip // empty')
-            sleep 1
+            output=$(orka-engine vm list -o json | jq -r --arg name "$vm_name" '.[] | select(.name == $name) | .ip // empty') || true
+            if [ -z "$output" ]; then
+              itr=$((itr + 1))
+              if [ $((itr % 12)) -eq 0 ]; then
+                echo "=== No IP after $((itr * 5))s ==="
+                orka-engine vm list || true
+              fi
+              sleep 5
+            fi
           done
           echo "VM_IP=$output" >> "$GITHUB_OUTPUT"
 
+      - name: Wait for SSH
+        if: env.SKIP_IMAGE != 'true'
+        timeout-minutes: 15
+        env:
+          VM_DEFAULT_PASSWORD: ${{ secrets.VM_DEFAULT_PASSWORD }}
+        run: |
+          vm_ip="${{ steps.vm-ip.outputs.VM_IP }}"
+          attempt=0
+          until sshpass -p "${VM_DEFAULT_PASSWORD}" \
+            ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null \
+            -o ConnectTimeout=5 \
+            "admin@${vm_ip}" "echo ok" &>/dev/null; do
+            attempt=$((attempt + 1))
+            if [ $((attempt % 6)) -eq 0 ]; then
+              echo "=== Waiting for SSH ($((attempt * 5))s elapsed) ==="
+              ps aux | grep -i RunVZ | grep -v grep || echo "-- RunVZ: (not running)"
+              sshpass -p "${VM_DEFAULT_PASSWORD}" \
+                ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null \
+                -o ConnectTimeout=5 \
+                "admin@${vm_ip}" "echo ok" 2>&1 || true
+            fi
+            sleep 5
+          done
+
       - name: Copy scripts into VM
         if: env.SKIP_IMAGE != 'true'
         env:
@@ -180,7 +223,93 @@ jobs:
             ${{ steps.vars.outputs.TEMP_NAME }} \
             ghcr.io/macstadium/orka-images/${{ matrix.name }}:${{ matrix.tag }}
 
+      - name: Run VM in recovery for no-SIP variant
+        if: ${{ (inputs.noSip == true || inputs.noSip == 'true') && env.SKIP_IMAGE != 'true' }}
+        run: |
+          sudo launchctl asuser "$(id -u)" /usr/local/bin/orka-engine vm run ${{ steps.vars.outputs.NOSIP_VM_NAME }} \
+            --image ${{ steps.vars.outputs.TEMP_NAME }} \
+            --recovery \
+            --vnc-port 5901 \
+            --disable-graphical-console \
+            -d
+
+      - name: Wait for recovery VM IP
+        if: ${{ (inputs.noSip == true || inputs.noSip == 'true') && env.SKIP_IMAGE != 'true' }}
+        timeout-minutes: 10
+        id: nosip-ip
+        run: |
+          vm_name="${{ steps.vars.outputs.NOSIP_VM_NAME }}"
+          output=""
+          itr=0
+          while [ -z "$output" ]; do
+            output=$(orka-engine vm list -o json | jq -r --arg name "$vm_name" '.[] | select(.name == $name) | .ip // empty') || true
+            if [ -z "$output" ]; then
+              itr=$((itr + 1))
+              if [ $((itr % 12)) -eq 0 ]; then
+                echo "=== No IP after $((itr * 5))s ==="
+                orka-engine vm list || true
+              fi
+              sleep 5
+            fi
+          done
+          echo "NOSIP_VM_IP=$output" >> "$GITHUB_OUTPUT"
+
+      - name: Disable SIP via VNC
+        if: ${{ (inputs.noSip == true || inputs.noSip == 'true') && env.SKIP_IMAGE != 'true' }}
+        timeout-minutes: 10
+        env:
+          VM_DEFAULT_PASSWORD: ${{ secrets.VM_DEFAULT_PASSWORD }}
+        run: |
+          python3 setup/vnc-disable-sip.py \
+            --host 127.0.0.1 \
+            --port 5901 \
+            --username admin \
+            --password "${VM_DEFAULT_PASSWORD}"
+
+      - name: Wait for no-SIP VM to come back online
+        if: ${{ (inputs.noSip == true || inputs.noSip == 'true') && env.SKIP_IMAGE != 'true' }}
+        timeout-minutes: 10
+        env:
+          VM_DEFAULT_PASSWORD: ${{ secrets.VM_DEFAULT_PASSWORD }}
+        run: |
+          nosip_ip="${{ steps.nosip-ip.outputs.NOSIP_VM_IP }}"
+          while ! sshpass -p "${VM_DEFAULT_PASSWORD}" \
+            ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null \
+            "admin@${nosip_ip}" "echo 'VM is back online'" &>/dev/null; do
+              sleep 5
+          done
+
+      - name: Verify SIP is disabled
+        if: ${{ (inputs.noSip == true || inputs.noSip == 'true') && env.SKIP_IMAGE != 'true' }}
+        env:
+          VM_DEFAULT_PASSWORD: ${{ secrets.VM_DEFAULT_PASSWORD }}
+        run: |
+          sshpass -p "${VM_DEFAULT_PASSWORD}" \
+            ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null \
+            "admin@${{ steps.nosip-ip.outputs.NOSIP_VM_IP }}" \
+            "csrutil status | grep -q 'disabled'"
+
+      - name: Save and push no-SIP image
+        if: ${{ (inputs.noSip == true || inputs.noSip == 'true') && env.SKIP_IMAGE != 'true' }}
+        timeout-minutes: 10
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          orka-engine vm save ${{ steps.vars.outputs.NOSIP_VM_NAME }} \
+            ${{ steps.vars.outputs.NOSIP_TEMP_NAME }}
+
+          orka-engine image push \
+            --username ${{ github.actor }} \
+            --password "${GITHUB_TOKEN}" \
+            ${{ steps.vars.outputs.NOSIP_TEMP_NAME }} \
+            ghcr.io/macstadium/orka-images/${{ matrix.name }}:${{ matrix.tag }}-no-sip
+
       - name: Cleanup
         if: always() && env.SKIP_IMAGE != 'true'
         run: |
-          orka-engine vm delete -f ${{ steps.vars.outputs.VM_NAME }}
+          sudo launchctl asuser "$(id -u)" /usr/local/bin/orka-engine vm delete -f ${{ steps.vars.outputs.VM_NAME }}
+
+      - name: Cleanup no-SIP VM
+        if: always() && (inputs.noSip == true || inputs.noSip == 'true') && env.SKIP_IMAGE != 'true'
+        run: |
+          sudo launchctl asuser "$(id -u)" /usr/local/bin/orka-engine vm delete -f ${{ steps.vars.outputs.NOSIP_VM_NAME }}

setup/vnc-disable-sip.py

@@ -0,0 +1,112 @@
+#!/usr/bin/env python3
+"""
+Disables SIP in macOS Recovery via VNC.
+
+Boot the VM with --recovery and --vnc-port, then run this script to open
+Terminal from the Recovery Utilities menu, run csrutil disable, and reboot.
+
+Usage:
+  python3 vnc-disable-sip.py --host 127.0.0.1 --port 5901 --username admin --password <admin_password>
+
+Requirements:
+  pip install vncdotool
+"""
+
+import argparse
+import sys
+import time
+
+try:
+    import vncdotool.api as vncapi
+except ImportError:
+    print("vncdotool is required: pip install vncdotool", file=sys.stderr)
+    sys.exit(1)
+
+
+class VNCSession:
+    def __init__(self, host, port):
+        self.client = vncapi.connect(host, port=port)
+
+    def close(self):
+        self.client.disconnect()
+
+    def wait(self, seconds):
+        time.sleep(seconds)
+
+    def key(self, name):
+        self.client.keyPress(name)
+
+    def type(self, text):
+        self.client.type(text)
+
+    def ctrl_f2(self):
+        # Ctrl+F2 focuses the Apple menu on macOS (accessibility keyboard shortcut)
+        self.client.keyDown('ctrl_l')
+        self.client.keyPress('F2')
+        self.client.keyUp('ctrl_l')
+
+
+def disable_sip(vnc, username, password):
+    print("Waiting for Recovery UI to load...")
+    vnc.wait(90)
+
+    # Focus Apple menu via Ctrl+F2, then navigate right to Utilities
+    # Menu order: [Apple] [File] [Edit] [Utilities] [Window] [Help]
+    print("Opening Utilities > Terminal...")
+    vnc.ctrl_f2()
+    vnc.wait(1)
+
+    for _ in range(3):
+        vnc.key('Right')
+        vnc.wait(0.3)
+
+    vnc.key('Return')
+    vnc.wait(1)
+
+    # Jump to Terminal by pressing 't' in the open menu
+    vnc.key('t')
+    vnc.wait(0.5)
+    vnc.key('Return')
+
+    print("Waiting for Terminal to open...")
+    vnc.wait(5)
+
+    print("Disabling SIP...")
+    vnc.type('csrutil disable')
+    vnc.key('Return')
+    vnc.wait(3)
+
+    # csrutil disable prompts for admin username and password in Recovery
+    vnc.type(username)
+    vnc.key('Return')
+    vnc.wait(2)
+
+    vnc.type(password)
+    vnc.key('Return')
+    vnc.wait(5)
+
+    print("Rebooting...")
+    vnc.type('reboot')
+    vnc.key('Return')
+
+
+def main():
+    parser = argparse.ArgumentParser(description='Disable SIP in macOS Recovery via VNC')
+    parser.add_argument('--host', required=True, help='VNC server host')
+    parser.add_argument('--port', type=int, default=5901, help='VNC port (default: 5901)')
+    parser.add_argument('--username', required=True, help='Admin username for csrutil authentication')
+    parser.add_argument('--password', required=True, help='Admin password for csrutil authentication')
+    args = parser.parse_args()
+
+    print(f'Connecting to VNC at {args.host}:{args.port}...')
+    vnc = VNCSession(args.host, args.port)
+
+    try:
+        disable_sip(vnc, args.username, args.password)
+        print('SIP disable sequence complete. Waiting for VM to reboot...')
+    finally:
+        vnc.close()
+
+
+if __name__ == '__main__':
+    main()