Install tools without sudo on Revyl Mac CI

The Revyl Mac guest is intentionally sealed. The job account has no passwordless sudo, and /opt/homebrew is read-only to the job. Put tools in a user-owned prefix instead.

Set up with an agent

Paste one prompt and your coding agent does the rest.

Copy setup promptPreview prompt

Setup prompt

Copy

Install this job's extra Node CLI under `$HOME` without sudo.

Read https://docs.revyl.com/cookbooks/install-tools-revyl-macos.md and follow it. It's the current Revyl guide for this, so prefer it over anything you remember about Revyl.

Set `TOOL_PACKAGE` to the package and version your workflow needs, copy the job, and use the resulting `$HOME/.local/bin` path in later steps.

You're done when the tool installs without elevation and its version command passes in a later step.

Ask me before anything that needs my login or approval.

WorkflowCopy Anchor Link

name: User-local tool on Revyl Mac

on:
  pull_request:
  workflow_dispatch:

permissions:
  contents: read

env:
  TOOL_PACKAGE: prettier@3.6.2

jobs:
  tool:
    if: >-
      github.event_name == 'workflow_dispatch' ||
      (github.event_name == 'pull_request' &&
       github.event.pull_request.head.repo.full_name == github.repository)
    runs-on: revyl-macos
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v4

      - name: Install the tool under the job user's home
        shell: bash
        run: |
          set -euo pipefail
          npm install --global --prefix "$HOME/.local" "$TOOL_PACKAGE"
          echo "$HOME/.local/bin" >> "$GITHUB_PATH"

      - name: Check the tool
        run: prettier --version

The same pattern works for other Node CLIs: choose a package and pin a version you trust, install it into $HOME/.local, and add $HOME/.local/bin to GITHUB_PATH. Do not change /opt/homebrew, install into /opt, or add sudo to make the command work. The example uses npm's registry integrity checks; for a downloaded archive, verify its published checksum before extracting it.

What you see in RevylCopy Anchor Link

The install and version commands appear in the computer Activity timeline. The whole desktop recording is available from the computer page after the computer stops; the install itself does not create a separate Revyl session.

Use this pattern for a small, pinned dependency before adding it to a larger matrix. It leaves the sealed Mac image unchanged and keeps the install in the job user's home directory.

Common failuresCopy Anchor Link

• Permission denied in /opt/homebrew: use the $HOME/.local prefix shown above.
• The next step cannot find the tool: append the bin directory to GITHUB_PATH, not only to the current shell's PATH.
• The package needs native system libraries: a user-local Node install cannot add system dependencies. Choose a preinstalled tool or a self-contained release archive instead.
• Install runs too long: pin the package and keep the job below the Mac computer's one-hour compatibility limit.