fix(ci): preserve hosted macOS DNS during fleet setup

.github/actions/setup-bazel/action.yml

@@ -193,6 +193,12 @@ runs:
         sudo chmod 0440 /etc/sudoers.d/tailscale-ci-network
         sudo visudo -cf /etc/sudoers.d/tailscale-ci-network
 
+    - name: Read the hosted Mac's Ethernet resolver settings
+      id: macos-dns
+      if: runner.os == 'macOS' && inputs.tailscale-client-id != ''
+      shell: bash
+      run: python3 "$GITHUB_ACTION_PATH/macos_dns.py" read >> "$GITHUB_OUTPUT"
+
     - name: Connect to the private Bazel fleet
       id: tailscale
       if: inputs.tailscale-client-id != ''
@@ -207,6 +213,15 @@ runs:
         args: --accept-dns=false
         ping: ubuntu-main
 
+    # The pinned Tailscale action explicitly reconfigures Ethernet when MagicDNS
+    # is enabled on macOS, even when tailscale up receives --accept-dns=false.
+    - name: Restore the hosted Mac's Ethernet resolver settings
+      if: always() && steps.macos-dns.outcome == 'success'
+      shell: bash
+      env:
+        ETHERNET_DNS: ${{ steps.macos-dns.outputs.settings }}
+      run: python3 "$GITHUB_ACTION_PATH/macos_dns.py" restore
+
     - name: Select private executor or hosted execution
       id: fleet
       shell: bash

.github/actions/setup-bazel/macos_dns.py

@@ -0,0 +1,42 @@
+"""Preserve the Ethernet settings changed by the Tailscale macOS action."""
+
+import json
+import os
+import subprocess
+import sys
+
+
+# networksetup returns one line per entry, or a sentence when DHCP supplies it.
+SETTINGS = {"dnsservers": "DNS Servers", "searchdomains": "Search Domains"}
+
+
+def read_settings(service):
+    settings = {}
+    for option, label in SETTINGS.items():
+        value = subprocess.check_output(
+            ["networksetup", "-get" + option, service],
+            text=True,
+            env={**os.environ, "LC_ALL": "C"},
+        ).strip()
+        if not value:
+            raise ValueError(f"networksetup returned no result for {option}")
+        automatic = f"There aren't any {label} set on {service}."
+        settings[option] = [] if value == automatic else value.splitlines()
+    return settings
+
+
+def restore_settings(service, settings):
+    for option in SETTINGS:
+        subprocess.run(
+            ["networksetup", "-set" + option, service, *(settings[option] or ["Empty"])],
+            check=True,
+        )
+
+
+if __name__ == "__main__":
+    if sys.argv[1:] == ["read"]:
+        print("settings=" + json.dumps(read_settings("Ethernet")))
+    elif sys.argv[1:] == ["restore"]:
+        restore_settings("Ethernet", json.loads(os.environ["ETHERNET_DNS"]))
+    else:
+        sys.exit("expected read or restore")