Repository navigation
fix(ci): preserve hosted macOS DNS during fleet setup - #4838
Conversation
|
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
| def restore_settings(service, settings): | ||
| for option in SETTINGS: | ||
| subprocess.run( | ||
| ["networksetup", "-set" + option, service, *(settings[option] or ["Empty"])], | ||
| check=True, | ||
| ) |
There was a problem hiding this comment.
🟡 Resolver restoration lacks regression coverage
Changes to restore_settings can break automatic or explicit DNS restoration without failing a checked-in test. The new reader and writer have no committed tests.
Learn more
This shared CI action reads macOS resolver settings before Tailscale enrollment and restores them afterward. Both behaviors are new, but no committed test exercises the parser or the networksetup commands. The repository requires test coverage for new behavior. Local manual verification does not catch later changes to the action.
Example: Given automatic DNS and two explicit search domains, a mock networksetup can return the automatic DNS sentence and two domain lines. A test can check that restoration passes Empty for DNS and both original domains in order.
Recommended fix: Add checked-in tests for read_settings and restore_settings using mocked subprocess results. Cover automatic values, ordered explicit lists, and failed networksetup commands; run them through a maintained test target.
Was this helpful? React with 👍 or 👎 to provide feedback.
The hosted Mac enrolled in the Bazel fleet, then immediately lost DNS for both the GitHub cache and releases.bazel.build. Bazel never started. The log shows Tailscale's action replaced Ethernet DNS with 100.100.100.100 even though this repository passed --accept-dns=false. Its pinned implementation explicitly calls networksetup for both DNS servers and search domains when the tailnet enables MagicDNS. The fleet coordinator is already resolved through Tailscale's local API and uses its IP address. Failed macOS setup · Pinned upstream implementation
The shared composite action reads both Ethernet settings before enrollment and restores them afterwards, including when enrollment fails. DHCP-provided configuration restores using the native Empty argument. Explicit lists retain their original order. The restore step runs before cache access and Bazel.
I read an actual macOS network service with automatic DNS and search domains using the production reader. Local tests checked the arguments passed to networksetup for automatic configuration, multiple IPv4/IPv6 resolvers and multiple search domains. No local network settings were modified. The composite YAML and actionlint passed. Hosted macOS verification is required to verify the real resolver and fleet together.
Hosted native macOS agent-hosts and Linux verification.
The hosted native macOS job passed. On the dependent #4836 head the runner log shows the Tailscale DNS override, restoration of Ethernet settings, a fresh download of Bazel 9.3.2 from releases.bazel.build, and 574 passing agent-hosts tests with one opt-in evaluation ignored.
Draft shared CI prerequisite. This PR is stacked on the Linux download fix so a dependent PR can use both verified runner setup changes.