fleet/.github/workflows/test-fma-darwin-validate.yml

# Reusable workflow that installs and validates a set of macOS Fleet-maintained
# apps. Called by test-fma-darwin-pr-only.yml and test-fma-darwin.yml with a
# matrix produced by .github/scripts/partition-fma-apps.sh. All darwin apps run
# on the arm64 macos-latest runner (x86-only casks run under Rosetta 2, which
# matches how customer Macs run them), so unlike Windows there is no
# per-architecture routing.
name: Validate Fleet Maintained Apps - Darwin

on:
  workflow_call:
    inputs:
      runner:
        description: 'Runner label to validate on (e.g. "macos-latest")'
        required: true
        type: string
      slugs:
        description: 'JSON array of app slugs to validate (e.g. ["box-drive/darwin"])'
        required: true
        type: string
      log_level:
        description: "Log level (debug, info, warn, error)"
        required: false
        type: string
        default: "info"

env:
  GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
  LOG_LEVEL: ${{ inputs.log_level }}

permissions:
  contents: read

jobs:
  validate:
    runs-on: ${{ inputs.runner }}

    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
        with:
          egress-policy: audit

      # Changed-app detection and sharding happen in the calling workflow on a
      # Linux runner, so no git history is needed here.
      - name: Checkout Fleet
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          fetch-depth: 1
          path: fleet
          persist-credentials: false

      - name: Setup Go
        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
        with:
          go-version-file: "fleet/go.mod"

      - name: Determine pre-installed apps to remove
        id: check-darwin-apps
        # Pass the slugs through env rather than expanding ${{ inputs.slugs }}
        # into the script body (flagged by zizmor as template injection).
        env:
          SLUGS_JSON: ${{ inputs.slugs }}
        run: |
          echo "Apps to validate on this $(uname -m) runner:"
          echo "$SLUGS_JSON" | jq -r '.[] | "  - \(.)"'

          # The runner images ship with some of the apps we validate already
          # installed (or bundled, in Icon Composer's case); flag the ones
          # present in this shard so the steps below start the validator from
          # a clean state.
          has_flag() {
            echo "$SLUGS_JSON" | jq -e --arg slug "$1" 'index($slug) != null' > /dev/null && echo "true" || echo "false"
          }
          {
            echo "has_google_chrome=$(has_flag 'google-chrome/darwin')"
            echo "has_icon_composer=$(has_flag 'icon-composer/darwin')"
            echo "has_fleet_desktop=$(has_flag 'fleet-desktop/darwin')"
          } >> "$GITHUB_OUTPUT"
        shell: bash

      - name: Install osquery mac
        run: |
          echo "Runner architecture: $(uname -m)"
          curl -L -o osquery.tar.gz "https://github.com/osquery/osquery/releases/download/5.18.1/osquery-5.18.1_1.macos_arm64.tar.gz"
          tar -xzf osquery.tar.gz
          sudo cp -r opt /
          sudo cp -r private /
          sudo ln -sf /opt/osquery/lib/osquery.app/Contents/MacOS/osqueryd /usr/local/bin/osqueryi
          sudo ln -sf /opt/osquery/lib/osquery.app/Contents/Resources/osqueryctl /usr/local/bin/osqueryctl

      - name: Remove pre-installed google chrome mac
        if: steps.check-darwin-apps.outputs.has_google_chrome == 'true'
        run: |
          find /Applications -maxdepth 1 -iname "*chrome*"
          find /Applications -name "*Chrome*.app" -type d | while read -r app;
          do
            echo "Removing $app..."
            sudo rm -rf "$app"
          done

      # Icon Composer ships bundled inside Xcode, and GitHub macOS runners
      # come with Xcode pre-installed. Remove it so the Icon Composer FMA
      # install script is validated against a clean install rather than an
      # already-present copy. Only runs when icon-composer/darwin is being
      # validated in this shard.
      - name: Remove pre-installed Xcode mac
        if: steps.check-darwin-apps.outputs.has_icon_composer == 'true'
        run: |
          find /Applications -maxdepth 1 -iname "Xcode*"
          find /Applications -maxdepth 1 -iname "Xcode*.app" -type d | while read -r app;
          do
            echo "Removing $app..."
            sudo rm -rf "$app"
          done

      # Fleet Desktop's installer refuses to run unless the
      # com.fleetdm.fleetd.config managed preferences profile is present
      # (it's normally delivered via MDM). CI runners aren't MDM-enrolled,
      # so we drop a stub plist in place before the validate step so the
      # install script succeeds. This only runs when fleet-desktop/darwin
      # is actually being validated in this shard.
      - name: Create Fleet Desktop MDM config stub (CI-only)
        if: steps.check-darwin-apps.outputs.has_fleet_desktop == 'true'
        run: |
          sudo mkdir -p "/Library/Managed Preferences"
          sudo tee "/Library/Managed Preferences/com.fleetdm.fleetd.config.plist" > /dev/null <<'PLIST'
          <?xml version="1.0" encoding="UTF-8"?>
          <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
          <plist version="1.0">
          <dict>
              <key>EnrollSecret</key>
              <string>ci-test-placeholder</string>
              <key>FleetURL</key>
              <string>https://ci.test.example.com</string>
          </dict>
          </plist>
          PLIST
          sudo chmod 644 "/Library/Managed Preferences/com.fleetdm.fleetd.config.plist"
          ls -l "/Library/Managed Preferences/com.fleetdm.fleetd.config.plist"

      - name: Filter apps.json and validate apps
        # Pass the slugs through env rather than expanding ${{ inputs.slugs }}
        # into the script body (flagged by zizmor as template injection).
        env:
          SLUGS_JSON: ${{ inputs.slugs }}
        run: |
          cd fleet
          # Set GITHUB_WORKSPACE to current directory so scripts can find files
          export GITHUB_WORKSPACE="$PWD"

          # The shard's slugs arrive as a compact JSON array string built by
          # the partition script, ready for filter-apps-json.sh as-is.
          echo "Filtering apps.json for slugs: $SLUGS_JSON"

          # Backup original apps.json
          cp ee/maintained-apps/outputs/apps.json ee/maintained-apps/outputs/apps.json.backup

          # Create filtered apps.json
          FILTERED_APPS_JSON=$(mktemp)
          .github/scripts/filter-apps-json.sh "$SLUGS_JSON" "$FILTERED_APPS_JSON"

          # Replace apps.json with filtered version
          mv "$FILTERED_APPS_JSON" ee/maintained-apps/outputs/apps.json

          # Run validation
          ls /Applications
          sudo -E go run ./cmd/maintained-apps/validate

          # Restore original apps.json
          mv ee/maintained-apps/outputs/apps.json.backup ee/maintained-apps/outputs/apps.json