Hey y'all, I am doing a blog post on how to setup a Gitlab CI/CD pipeline to test updates to Osquery configs for each OS flavor (Windows, Linux, and macOS). The goal being being that a detection engineer can modify an OS specific Osquery config,

git push

the changes to Gitlab, and the CI/CD pipeline would test the OS specific Osquery config on the correct OS. For testing Linux and Windows I am using Docker containers. However for macOS, the OS itself has not been containerized. Currently, I have a macOS VM running on my personal macbook with a gitlab runner. While this setup works it has two issues. One, I need to keep a long lived macOS VM (not to mention macOS VMs are not officially supported to run non-mac hardware) running just to test an Osquery config. Two, a VM doesn't provide a "clean" env on every CI/CD pipeline run - artifacts left over from previous builds or different project builds. My ask to the Osquery community is how does everyone test Osquery configs on macOS before deploying to production? My hope is to find a better method to running macOS to test an Osquery config than a long lived VM.