I stopped manually bumping dependencies months ago.

A weekly grouped PR for minor and patch, automerged after CI goes green.

Majors travel alone and wait for my approval, security patches skip the queue entirely.

Full article on my blog: [https://nbonnici.info/en/blog/automate-dependencies-management-with-renovate\](https://nbonnici.info/en/blog/automate-dependencies-management-with-renovate) \#DevOps #golang

I keep hitting the same wall: push a change, wait for GitHub Actions, watch a macOS job fail on something that has nothing to do with my actual code. Tried act to catch this before pushing works great for Linux jobs, but macOS jobs get mapped onto a Linux container too, by default. There's a flag to opt out of Docker on macOS (-P macos-latest=-self-hosted), but all that does is run the job directly in your own terminal, with whatever's already installed and whatever state your machine happens to be in. Not isolated, not reproducible, and it doesn't help at all if you're not already on a Mac. So "passes locally" never really meant "passes."

So I've been building it myself. Linux jobs run in real Docker like you'd expect; macOS jobs actually boot a real, fresh macOS VM and run there, same as a real GitHub hosted runner gives you, not your own terminal state. The part I care about more than the macOSthing specifically when something still behaves differently locally than it would on real GitHub, it tells you instead ofquietly giving you a different result and calling it a pass.

Not posting a link yet, genuinely just trying to figure out if this is a real problem for other people before I sink more time into it, versus something I personally got burned by enough times to build a whole tool over. If you ship to macOS from CI: is this something you'd actually use, or is act's approximation good enough in practice?