fix: support first-install macOS runner checks

roles/github_runner_macos_actions_runner/handlers/main.yml

@@ -1,13 +1,15 @@
 ---
-- name: Restart macOS Actions runner
+- name: Stop the previous macOS Actions runner launch daemon
+  listen: Restart macOS Actions runner
   become: true
-  block:
-    - name: Stop the previous runner launch daemon
-      ansible.builtin.command:
-        argv: [launchctl, bootout, "system/{{ github_runner_macos_actions_runner_launchd_label }}"]
-      failed_when: false
-      changed_when: false
-    - name: Start the runner launch daemon
-      ansible.builtin.command:
-        argv: [launchctl, bootstrap, system, "{{ github_runner_macos_actions_runner_plist }}"]
-      changed_when: true
+  ansible.builtin.command:
+    argv: [launchctl, bootout, "system/{{ github_runner_macos_actions_runner_launchd_label }}"]
+  failed_when: false
+  changed_when: false
+
+- name: Start the macOS Actions runner launch daemon
+  listen: Restart macOS Actions runner
+  become: true
+  ansible.builtin.command:
+    argv: [launchctl, bootstrap, system, "{{ github_runner_macos_actions_runner_plist }}"]
+  changed_when: true

roles/github_runner_macos_actions_runner/tasks/main.yml

@@ -114,6 +114,7 @@
       changed_when: false
       failed_when: false
       check_mode: false
+      when: not ansible_check_mode or github_runner_macos_actions_runner_account.rc == 0
 
     - name: Download the pinned Apple Silicon runner package
       become: true
@@ -122,21 +123,23 @@
         dest: "{{ github_runner_macos_actions_runner_root }}-{{ github_runner_macos_actions_runner_version }}.tar.gz"
         checksum: "sha256:{{ github_runner_macos_actions_runner_sha256 }}"
         mode: "0644"
-      when: github_runner_macos_actions_runner_installed_version.stdout | trim != github_runner_macos_actions_runner_version
+      when:
+        - not ansible_check_mode
+        - github_runner_macos_actions_runner_installed_version.stdout | default('') | trim != github_runner_macos_actions_runner_version
 
     - name: Stop the runner before replacing its installation
       become: true
       ansible.builtin.command:
         argv: [launchctl, bootout, "system/{{ github_runner_macos_actions_runner_launchd_label }}"]
       failed_when: false
       changed_when: false
-      when: github_runner_macos_actions_runner_installed_version.stdout | trim != github_runner_macos_actions_runner_version
+      when: github_runner_macos_actions_runner_installed_version.stdout | default('') | trim != github_runner_macos_actions_runner_version
 
     - name: Remove the prior runner installation
       ansible.builtin.file:
         path: "{{ github_runner_macos_actions_runner_root }}"
         state: absent
-      when: github_runner_macos_actions_runner_installed_version.stdout | trim != github_runner_macos_actions_runner_version
+      when: github_runner_macos_actions_runner_installed_version.stdout | default('') | trim != github_runner_macos_actions_runner_version
 
     - name: Recreate the runner directory
       become: true
@@ -145,7 +148,7 @@
         state: directory
         owner: "{{ github_runner_macos_actions_runner_user }}"
         mode: "0750"
-      when: github_runner_macos_actions_runner_installed_version.stdout | trim != github_runner_macos_actions_runner_version
+      when: github_runner_macos_actions_runner_installed_version.stdout | default('') | trim != github_runner_macos_actions_runner_version
 
     - name: Install the pinned Apple Silicon runner package
       become: true
@@ -154,7 +157,9 @@
         dest: "{{ github_runner_macos_actions_runner_root }}"
         remote_src: true
         owner: "{{ github_runner_macos_actions_runner_user }}"
-      when: github_runner_macos_actions_runner_installed_version.stdout | trim != github_runner_macos_actions_runner_version
+      when:
+        - not ansible_check_mode
+        - github_runner_macos_actions_runner_installed_version.stdout | default('') | trim != github_runner_macos_actions_runner_version
 
     - name: Check whether the runner is registered
       ansible.builtin.stat:
@@ -203,6 +208,7 @@
           register: github_runner_macos_actions_runner_installation_token
 
         - name: Request a runner registration token
+          when: not ansible_check_mode
           ansible.builtin.uri:
             url: "https://api.github.com/repos/{{ github_runner_macos_actions_runner_organization }}/{{ github_runner_macos_actions_runner_repository }}/actions/runners/registration-token"
             method: POST
@@ -239,7 +245,9 @@
         ACTIONS_RUNNER_INPUT_TOKEN: "{{ github_runner_macos_actions_runner_registration_token.json.token }}"
       no_log: true
       changed_when: true
-      when: not github_runner_macos_actions_runner_registration.stat.exists
+      when:
+        - not ansible_check_mode
+        - not github_runner_macos_actions_runner_registration.stat.exists
 
     - name: Install the runner launch daemon
       become: true

tests/unit/test_macos_actions_runner_check.py

@@ -0,0 +1,29 @@
+"""Check-mode regression tests for a macOS runner on a host with no runner account."""
+
+from pathlib import Path
+import unittest
+
+import yaml
+
+ROOT = Path(__file__).resolve().parents[2]
+ROLE = ROOT / "roles" / "github_runner_macos_actions_runner"
+
+
+class MacOSActionsRunnerCheckTest(unittest.TestCase):
+    def test_first_install_does_not_become_the_not_yet_created_user(self) -> None:
+        tasks = yaml.safe_load((ROLE / "tasks" / "main.yml").read_text())
+        enabled = next(task for task in tasks if task["name"] == "Configure the enabled macOS runner")
+        entries = {task["name"]: task for task in enabled["block"]}
+        self.assertIn("not ansible_check_mode or github_runner_macos_actions_runner_account.rc == 0", entries["Check the installed runner version"]["when"])
+        for name in ("Download the pinned Apple Silicon runner package", "Install the pinned Apple Silicon runner package", "Configure the macOS runner"):
+            self.assertIn("not ansible_check_mode", entries[name]["when"])
+
+    def test_launchd_restart_listeners_are_real_handlers(self) -> None:
+        handlers = yaml.safe_load((ROLE / "handlers" / "main.yml").read_text())
+        listeners = [handler for handler in handlers if handler.get("listen") == "Restart macOS Actions runner"]
+        self.assertEqual(len(listeners), 2)
+        self.assertTrue(all("ansible.builtin.command" in handler for handler in listeners))
+
+
+if __name__ == "__main__":
+    unittest.main()