MacAdmins Conference, July 7, 2026 Format: Half-day hands-on build-along
Most application repos get linters, secret scanners, and CI pipelines. Shell script repos, including the ones running on your entire Mac fleet, often get none of that. This workshop closes the gap.
You'll build a complete GitOps pipeline from scratch: a versioned script repo with secret scanning, shell linting, semantic versioning, and GitHub Actions CI. Then, at the end, you'll see how Shikomi scaffolds the whole thing in under two minutes.
Everything is built by hand first. The point isn't to hand you a framework - it's to make sure you understand every piece before you automate it.
Complete the Workshop Preparation Guide before the session.
Estimated prep time: 15 minutes. You'll need:
- macOS laptop (Catalina 10.15 or later)
- Admin access
- GitHub account (free tier is fine)
- Homebrew, Git, and GitHub CLI (
gh) installed and authenticated
The prep guide walks through all of this with a verification script you can run to confirm you're ready. Don't skip it - the workshop starts immediately with building, not setup.
By the end of the session, you'll have a working repo with:
| Component | What It Does |
|---|---|
| Git repo + versioned script | Baseline structure with a proper script header |
| Gitleaks | Blocks commits that contain secrets (API keys, tokens, passwords) |
| ShellCheck | Catches shell errors, bad quoting, and Jamf-specific pitfalls before they ship |
| bump-version | Manages semantic versioning in the script header and CHANGELOG |
| GitHub Actions CI | Enforces Gitleaks + ShellCheck on every pull request |
The final segment shows Shikomi, a scaffolding tool that generates all of the above for a new project in one command. You'll appreciate it more after building everything by hand.
| Segment | Content | Time |
|---|---|---|
| 1 | Context and why this matters | 15 min |
| 2 | Repo setup and baseline structure | 20 min |
| 3 | Secret scanning with Gitleaks | 35 min |
| - | Break | 10 min |
| 4 | Shell linting with ShellCheck | 30 min |
| 5 | Semantic versioning with bump-version | 25 min |
| 6 | GitHub Actions CI | 20 min |
| 7 | Review and tuning | 15 min |
| 8 | Shikomi reveal | 20 min |
| 9 | Wrap-up and Q&A | 20 min |
| File | What It's For |
|---|---|
| guide-workshop-preparation.md | Pre-workshop setup - complete this before the session |
| guide-no-homebrew.md | Installing workshop tools without Homebrew - pip3, direct binary download, and GitHub CLI .pkg paths |
| cheatsheet-gitops-workflow.md | One-page command reference for everything covered in the session |
| reference-pre-commit-hooks.md | Hook configuration, common error messages, fixes, and bypass options |
Copy these into your own repo as a starting point. Each file has comments explaining what each setting does and when to use it.
| File | What It's For |
|---|---|
| examples/my_script.sh | Sample script with the complete two-field version header, Jamf parameters, and logging functions |
| examples/my_ea.sh | Sample Extension Attribute with EA-specific patterns (set -uo pipefail, <result> output format) |
| examples/security-checks.yml | GitHub Actions CI workflow - save to .github/workflows/security-checks.yml in your repo |
| examples/deploy-to-jamf.yml | GitHub Actions deploy workflow - auto-deploys changed scripts to Jamf Pro on merge to main |
| examples/pre-commit-config-enhanced.yaml | Enhanced pre-commit config (all 9 checks) - copy to your repo root as .pre-commit-config.yaml |
| examples/gitleaks.toml | Gitleaks allowlist for suppressing false positives - copy to your repo root as .gitleaks.toml |
| examples/shellcheckrc | Per-repo ShellCheck config for severity level and file exclusions - copy to your repo root as .shellcheckrc |
| examples/credential_patterns.sh | Four patterns for loading secrets without hardcoding: Jamf parameter, .env file, macOS Keychain, and 1Password CLI |
| examples/gitignore | macOS-focused .gitignore template - copy to your repo root as .gitignore |
| examples/CODEOWNERS | Required reviewer assignments by file type - save to .github/CODEOWNERS in your repo |
| examples/setup.sh | New contributor setup script - installs pre-commit hooks and verifies tool installs |
| File | What It's For |
|---|---|
| guide-automated-deployment.md | Closing the loop - GitHub Actions workflow to auto-deploy scripts to Jamf Pro on merge (plus Kandji, Mosyle, and Intune) |
| guide-rollback.md | How to revert a bad deploy and get a fix to your fleet quickly |
| guide-secret-history-cleanup.md | What to do when a secret was committed before Gitleaks was in place |
| reference-repo-strategy.md | Monorepo vs. micro-repo tradeoffs and how to migrate existing scripts from Jamf |
| reference-team-workflow.md | Branch protection, CODEOWNERS, PR review guidelines, and multi-environment deploys |
Everything here is yours to keep. Clone this repo, reference it after the conference, and use it on your own projects.
- Shikomi: the scaffolding tool demonstrated in the final segment. Generates a versioned script project with Gitleaks, ShellCheck, bump-version, and optional GitHub Actions in one interactive command.
Questions about the prep steps? I'm happy to help get you sorted before we start.