Repository navigation
System Integrity Protection enabled on some macos-latest runners #9091
Description
Description
Some macos-latest runners have SIP enabled (example: https://github.com/mozilla/neqo/actions/runs/7394597662/job/20116394813#step:13:15) while most others do not (example: https://github.com/mozilla/neqo/actions/runs/7394597662/job/20116394906#step:13:14).
I see no other difference in the configuration of the runners, they all are:
Current runner version: '2.311.0'
Operating System
macOS
12.7.2
21G1974
Runner Image
Image: macos-12
Version: 20231216.1
Included Software: https://github.com/actions/runner-images/blob/macOS-12/20231216.1/images/macos/macos-12-Readme.md
Image Release: https://github.com/actions/runner-images/releases/tag/macOS-12%2F20231216.1
Runner Image Provisioner
2.0.321.1
Platforms affected
- Azure DevOps
- GitHub Actions - Standard Runners
- GitHub Actions - Larger Runners
Runner images affected
- Ubuntu 20.04
- Ubuntu 22.04
- macOS 11
- macOS 12
- macOS 13
- macOS 13 Arm64
- Windows Server 2019
- Windows Server 2022
Image version and build link
Is it regression?
Don't know, this is a new workflow
Expected behavior
Expected SIP to be consistently enabled or disabled (preferred).
Actual behavior
SIP seems to be disabled in ~90% of runs but enabled in ~10% of runs.
Activity
erik-bershel commentedon Jan 3, 2024
Hi @larseggert!
We invested in upgraded hardware to support
macOS-13and are retiring older hardware, both of these changes impactmacOS-12. Because of this, somemacOS-12agents do not yet support SIP. We recommend usingmacOS-13runners for workflows that require consistent SIP state.larseggert commentedon Jan 3, 2024
Is it possible to consistently disable SIP for a workflow run?
mikhailkoliada commentedon Jan 3, 2024
unfortunately, no, it is not possible.
ci: Add a note about SIP being enabled on part of the macos-12 runners
ci: Add a note about SIP being enabled on part of the macos-12 runners