Bring macOS runner updates from PR 674

varunsh-coder · varunsh-coder · commit eb9e1f4943b6 · 2026-07-01T07:08:34.000-07:00
diff --git a/dist/index.js b/dist/index.js
@@ -31919,6 +31919,8 @@ function detectThirdPartyRunnerProvider() {
         return "depot";
     if (process.env["NAMESPACE_GITHUB_RUNTIME"])
         return "namespace";
+    if (process.env["BITRISE_IO"])
+        return "bitrise";
     const runnerName = (_a = process.env["RUNNER_NAME"]) !== null && _a !== void 0 ? _a : "";
     if (runnerName.startsWith("warp-"))
         return "warp";
diff --git a/dist/index.js.map b/dist/index.js.map
diff --git a/dist/post/index.js b/dist/post/index.js
@@ -31925,6 +31925,8 @@ function detectThirdPartyRunnerProvider() {
         return "depot";
     if (process.env["NAMESPACE_GITHUB_RUNTIME"])
         return "namespace";
+    if (process.env["BITRISE_IO"])
+        return "bitrise";
     const runnerName = (_a = process.env["RUNNER_NAME"]) !== null && _a !== void 0 ? _a : "";
     if (runnerName.startsWith("warp-"))
         return "warp";
diff --git a/dist/post/index.js.map b/dist/post/index.js.map
diff --git a/dist/pre/index.js b/dist/pre/index.js
@@ -85117,6 +85117,8 @@ function detectThirdPartyRunnerProvider() {
         return "depot";
     if (process.env["NAMESPACE_GITHUB_RUNTIME"])
         return "namespace";
+    if (process.env["BITRISE_IO"])
+        return "bitrise";
     const runnerName = (_a = process.env["RUNNER_NAME"]) !== null && _a !== void 0 ? _a : "";
     if (runnerName.startsWith("warp-"))
         return "warp";
@@ -85551,7 +85553,7 @@ const CHECKSUMS = {
         amd64: "c986d0a19637325c9a8d4a331a6c4ed047e4cddb798f56b641d0e66f8bf9b1b2", // v1.8.12
         arm64: "5c3df17f82e317c8b288dfbbcee449c2a24a80deeeb3416dccabd0a61982c676", // v1.8.12
     },
-    darwin: "fe26a1f6af4afe9f1a854d8633832f5d18ab542827003cae445b3a64021d612c", // v0.0.5
+    darwin: "2990f0390d2760fa6262a3830060b6db1233f16a1410ffe1ed2bf13dfda80c38", // v0.0.6
     windows: {
         amd64: "5e3604d08aba65d7bdd1d0684826d5894ffb0c6f56b914c6ecb35c3271e04483", // v1.0.7
     },
@@ -85711,7 +85713,7 @@ function installMacosAgent(configStr) {
             external_fs_.writeFileSync("/opt/step-security/agent.json", configStr);
             lib_core.info("✓ Successfully created agent.json at /opt/step-security/agent.json");
             // Download installer package
-            const downloadUrl = "https://github.com/step-security/agent-releases/releases/download/v0.0.5-mac/macos-installer-0.0.5.tar.gz";
+            const downloadUrl = "https://github.com/step-security/agent-releases/releases/download/v0.0.6-mac/macos-installer-0.0.6.tar.gz";
             lib_core.info(`Downloading macOS installer.. : ${downloadUrl}`);
             const downloadPath = yield tool_cache.downloadTool(downloadUrl, undefined, auth);
             lib_core.info(`✓ Successfully downloaded installer to: ${downloadPath}`);
@@ -86089,15 +86091,26 @@ process.on("unhandledRejection", (reason) => {
             const thirdPartyProvider = detectThirdPartyRunnerProvider();
             if (thirdPartyProvider) {
                 const providerLabel = thirdPartyProvider.charAt(0).toUpperCase() + thirdPartyProvider.slice(1);
-                if (process.platform !== "linux") {
-                    lib_core.info(`Detected ${providerLabel} runner on ${process.platform}. Bravo agent is Linux-only, skipping install.`);
+                if (process.platform !== "linux" && process.platform !== "darwin") {
+                    lib_core.info(`Detected ${providerLabel} runner on ${process.platform}. HardenRunner is not supported on this third-party provider, skipping install.`);
                     return;
                 }
                 lib_core.info(`Detected ${providerLabel} runner environment. Installing agent-bravo.`);
                 confg.correlation_id = runnerName || confg.correlation_id;
                 yield callMonitorEndpoint(api_url, confg);
-                yield installAgentForBravo(github.context.repo.owner, confg);
-                return;
+                const bravoConfigStr = JSON.stringify(buildBravoConfig(confg));
+                switch (process.platform) {
+                    case "darwin": {
+                        const installed = yield installMacosAgent(bravoConfigStr);
+                        if (!installed) {
+                            lib_core.warning("macos bravo agent installation failed");
+                        }
+                        return;
+                    }
+                    case "linux":
+                        yield installAgentForBravo(github.context.repo.owner, bravoConfigStr);
+                        return;
+                }
             }
             external_fs_.appendFileSync(process.env.GITHUB_STATE, `selfHosted=true${external_os_.EOL}`, {
                 encoding: "utf8",
@@ -86338,7 +86351,7 @@ function installAgentForSelfHosted(owner, confg) {
         }
     });
 }
-function installAgentForBravo(owner, confg) {
+function installAgentForBravo(owner, bravoConfigStr) {
     return setup_awaiter(this, void 0, void 0, function* () {
         try {
             console.log("Installing Harden Runner bravo agent for third-party runner");
@@ -86347,7 +86360,6 @@ function installAgentForBravo(owner, confg) {
                 console.log("TLS is not enabled for this organization. Bravo agent installation skipped.");
                 return;
             }
-            const bravoConfigStr = JSON.stringify(buildBravoConfig(confg));
             external_child_process_.execSync("sudo mkdir -p /home/agent");
             chownForFolder(process.env.USER, "/home/agent");
             yield installAgentBravo(bravoConfigStr);
diff --git a/dist/pre/index.js.map b/dist/pre/index.js.map
diff --git a/src/checksum.ts b/src/checksum.ts
@@ -14,7 +14,7 @@ export const CHECKSUMS = {
     amd64: "c986d0a19637325c9a8d4a331a6c4ed047e4cddb798f56b641d0e66f8bf9b1b2", // v1.8.12
     arm64: "5c3df17f82e317c8b288dfbbcee449c2a24a80deeeb3416dccabd0a61982c676", // v1.8.12
   },
-  darwin: "fe26a1f6af4afe9f1a854d8633832f5d18ab542827003cae445b3a64021d612c", // v0.0.5
+  darwin: "2990f0390d2760fa6262a3830060b6db1233f16a1410ffe1ed2bf13dfda80c38", // v0.0.6
   windows: {
     amd64: "5e3604d08aba65d7bdd1d0684826d5894ffb0c6f56b914c6ecb35c3271e04483", // v1.0.7
   },
diff --git a/src/install-agent.ts b/src/install-agent.ts
@@ -143,7 +143,7 @@ export async function installMacosAgent(configStr: string): Promise<boolean> {
 
     // Download installer package
     const downloadUrl =
-      "https://github.com/step-security/agent-releases/releases/download/v0.0.5-mac/macos-installer-0.0.5.tar.gz";
+      "https://github.com/step-security/agent-releases/releases/download/v0.0.6-mac/macos-installer-0.0.6.tar.gz";
     core.info(`Downloading macOS installer.. : ${downloadUrl}`);
     const downloadPath = await tc.downloadTool(downloadUrl, undefined, auth);
     core.info(`✓ Successfully downloaded installer to: ${downloadPath}`);
diff --git a/src/setup.ts b/src/setup.ts
@@ -312,15 +312,26 @@ process.on("unhandledRejection", (reason) => {
       const thirdPartyProvider = detectThirdPartyRunnerProvider();
       if (thirdPartyProvider) {
         const providerLabel = thirdPartyProvider.charAt(0).toUpperCase() + thirdPartyProvider.slice(1);
-        if (process.platform !== "linux") {
-          core.info(`Detected ${providerLabel} runner on ${process.platform}. Bravo agent is Linux-only, skipping install.`);
+        if (process.platform !== "linux" && process.platform !== "darwin") {
+          core.info(`Detected ${providerLabel} runner on ${process.platform}. HardenRunner is not supported on this third-party provider, skipping install.`);
           return;
         }
         core.info(`Detected ${providerLabel} runner environment. Installing agent-bravo.`);
         confg.correlation_id = runnerName || confg.correlation_id;
         await callMonitorEndpoint(api_url, confg);
-        await installAgentForBravo(context.repo.owner, confg);
-        return;
+        const bravoConfigStr = JSON.stringify(buildBravoConfig(confg));
+        switch (process.platform) {
+          case "darwin": {
+            const installed = await installMacosAgent(bravoConfigStr);
+            if (!installed) {
+              core.warning("macos bravo agent installation failed");
+            }
+            return;
+          }
+          case "linux":
+            await installAgentForBravo(context.repo.owner, bravoConfigStr);
+            return;
+        }
       }
 
       fs.appendFileSync(process.env.GITHUB_STATE, `selfHosted=true${EOL}`, {
@@ -596,7 +607,7 @@ export async function installAgentForSelfHosted(owner: string, confg: Configurat
   }
 }
 
-export async function installAgentForBravo(owner: string, confg: Configuration) {
+export async function installAgentForBravo(owner: string, bravoConfigStr: string) {
   try {
     console.log("Installing Harden Runner bravo agent for third-party runner");
 
@@ -607,8 +618,6 @@ export async function installAgentForBravo(owner: string, confg: Configuration)
       return;
     }
 
-    const bravoConfigStr = JSON.stringify(buildBravoConfig(confg));
-
     cp.execSync("sudo mkdir -p /home/agent");
     chownForFolder(process.env.USER, "/home/agent");
 
diff --git a/src/utils.test.ts b/src/utils.test.ts
@@ -98,6 +98,7 @@ describe("detectThirdPartyRunnerProvider", () => {
     process.env = { ...originalEnv };
     delete process.env.DEPOT_RUNNER;
     delete process.env.NAMESPACE_GITHUB_RUNTIME;
+    delete process.env.BITRISE_IO;
     delete process.env.RUNNER_NAME;
   });
 
@@ -120,6 +121,11 @@ describe("detectThirdPartyRunnerProvider", () => {
     expect(detectThirdPartyRunnerProvider()).toBe("namespace");
   });
 
+  test("returns bitrise when BITRISE_IO is set", () => {
+    process.env.BITRISE_IO = "true";
+    expect(detectThirdPartyRunnerProvider()).toBe("bitrise");
+  });
+
   test("returns warp for RUNNER_NAME prefix warp-", () => {
     process.env.RUNNER_NAME = "warp-4x-x64-abc";
     expect(detectThirdPartyRunnerProvider()).toBe("warp");
diff --git a/src/utils.ts b/src/utils.ts
@@ -40,11 +40,12 @@ export function shouldDeployAgentOnSelfHosted(
   return deployOnSelfHostedVm && !isContainer && !agentAlreadyInstalled;
 }
 
-export type ThirdPartyRunnerProvider = "depot" | "namespace" | "warp" | "blacksmith";
+export type ThirdPartyRunnerProvider = "depot" | "namespace" | "warp" | "blacksmith" | "bitrise";
 
 export function detectThirdPartyRunnerProvider(): ThirdPartyRunnerProvider | null {
   if (process.env["DEPOT_RUNNER"] === "1") return "depot";
   if (process.env["NAMESPACE_GITHUB_RUNTIME"]) return "namespace";
+  if (process.env["BITRISE_IO"]) return "bitrise";
   const runnerName = process.env["RUNNER_NAME"] ?? "";
   if (runnerName.startsWith("warp-")) return "warp";
   if (runnerName.startsWith("blacksmith-")) return "blacksmith";
