Accessibility Permissions for app being tested

[godbout]

Description
i build an app that adds Vim bindings to the whole macOS. to test this currently the app needs Accessibility Permissions. i can't seem to find a way to make this happen with the current GitHub Action macOS environment.

Area for Triage:
Apple

Question, Bug, or Feature?:
Question

i have looked at the following issues but couldn't find a solution or confirmation that what i'm trying to achieve is not possible:

• Accessibility Permissions for the app deployed in macOS #1567
• Xcode Helper Accessibility Permissions for Github hosted runner #1441
• Disable SIP in Mac OS Catalina #650
• macOS cant run most of Apple Scripts because of UI block #553

Virtual environments affected

• Ubuntu 16.04
• Ubuntu 18.04
• Ubuntu 20.04
• macOS 10.15
• macOS 11.0
• Windows Server 2016 R2
• Windows Server 2019

Image version
Version: 20210423.1

Expected behavior
allow Accessibility Permissions to the app being tested.

Actual behavior
Accessibility Permissions not allowed.

Repro steps
run an app that requires Accessibility Permissions, like for example an app that creates event taps. even taps creation will fail.

[godbout]

as per the similar issues reported above, i tried to enable the Accessibility Permissions with

sudo sqlite3 "/Library/Application\ Support/com.apple.TCC/TCC.db" "insert into access (service, client, client_type, allowed, prompt_count, indirect_object_identifier, flags) values ('kTCCServiceAccessibility', 'mo.com.sleeplessmind.kindaVim', 0, 1, 1, 'UNUSED', 0)"

or

sudo sqlite3 "$HOME/Library/Application\ Support/com.apple.TCC/TCC.db" "insert into access (service, client, client_type, allowed, prompt_count, indirect_object_identifier, flags) values ('kTCCServiceAccessibility', 'mo.com.sleeplessmind.kindaVim', 0, 1, 1, 'UNUSED', 0)"

in the first case i'm told the db is not writable; in the second that there's no such db. if i understand correctly the first case is due to SIP, which you are not planning to disable through some options. so i'm just trying to confirm that there is nothing i can do currently to run my tests through GitHub Actions (without i guess rewriting my app so that in some kind of "test" mode it doesn't create a tap event. most of my tests should be decoupled so that they don't require a tap event to be run).

thanks a ton.

[maxim-lobanov]

Hello @godbout , as far as I know, it is not possible to enable Accessibility Permissions in runtime because Hosted runners have SIP enabled. These databases can be changed only with disabled SIP (System Integrity Protection).

[godbout]

hi @maxim-lobanov. thanks a ton for the swift answer! seems to confirm what i understood till now (first mac app here). may i just confirm with you that nothing that i could tick in Xcode (entitlements or anything else?) could help on this issue?

[maxim-lobanov]

@godbout , unfortunately, I can't answer. I don't have much experience with macOS / iOS development, our expertise is mostly related to configuring macOS environment so you shouldn't trust my words 😄

I would suggest to duplicate this question to GitHub Community Forum, I think someone has already faced with this issue and can help

[godbout]

i like this. i'm getting 40 this year and i'm realizing nobody has a fucking clue what they're doing and nobody should be trusted. me included 😂️

alright, thanks for the help. i'll check the forum. and i'll probably pull out the event tap from the tests anyways. doesn't have much use there. thanks again!

[godbout]

ok so jfi in case someone is having a similar issue, i ended up adding a Testing configuration, and a Swift Compiler Custom Flag as TESTING for this new configuration.

in my code, i now only activate the event tap if i'm not in TESTING configuration with:

#if !TESTING
    _ = EventTapController.init()
#endif

all my own unit test code is decoupled from Apple's API so it can be tested without interfering with the OS.
the GHA yml now calls the testing as: run: xcodebuild clean -scheme kindaVim -configuration Testing test

[godbout]

ah! a little update. i added UITests that are using the Accessibility API and i pushed to GitHub, before trying to find a way to exclude them from GHA. i was expecting them to fail due to the SIP thing, but they passed 😅️ wondering, is there any reason for that? like Xcode has been added to the TCC database even with the SIP on?

[godbout]

ok, strange. tests passed this morning, don't pass anymore now, with:

Found 1 interrupting element:
1770
    t =     0.89s         Window at {{357.0, 183.0}, {461.0, 171.0}} from Application 'com.apple.accessibility.universalAccessAuthWarn'
1771
    t =     0.89s     Invoking UI interruption monitors for Window at {{357.0, 183.0}, {461.0, 171.0}} from Application 'com.apple.accessibility.universalAccessAuthWarn'

so it seems that for whatever reason this morning this went through and now i guess the Accessibility window popping up, which i was expecting from the start. closing again i guess.