setup-xcode.sh

#!/bin/zsh
# shellcheck shell=bash

################################################################################
# Script:       setup-xcode.sh
# Description:  Configures Xcode post-installation to accept the license (EULA)
#               and install initial components (first launch) silently.
#               Designed for deployment via Microsoft Intune.
#
# Note:         Xcode itself must be installed via VPP (Apple Business Manager)
#               by Intune. This script only performs the setup so that users
#               without administrator privileges don't get password prompts.
#
# Author:       IT Team
# Version:      1.0.0
# Date:         2026-08-13
#
# Requirements:
#   - Xcode installed at /Applications/Xcode.app (via VPP)
#   - Run as root (Intune: "Run script as signed-in user" = No)
#
# Intune Configuration (Shell Script):
#   - Run script as signed-in user: No
#   - Hide script notifications: Yes
#   - Script frequency: Not configured (single execution after installation)
#   - Max retries: 3
################################################################################

set -euo pipefail

# =============================================================================
# CONFIGURATIONS
# =============================================================================

readonly APP_NAME="Xcode"
readonly APP_PATH="/Applications/Xcode.app"
readonly XCODEBUILD_BIN="/usr/bin/xcodebuild"
readonly XCODESELECT_BIN="/usr/bin/xcode-select"

# Logging (Intune standard)
readonly LOG_DIR="/Library/Logs/Microsoft/IntuneScripts/xcode"
readonly LOG_FILE="${LOG_DIR}/setup-xcode.log"

# Script version
readonly SCRIPT_VERSION="1.0.0"

# =============================================================================
# LOGGING FUNCTIONS
# =============================================================================

setup_logging() {
    if [[ ! -d "${LOG_DIR}" ]]; then
        mkdir -p "${LOG_DIR}"
    fi
    exec > >(tee -a "${LOG_FILE}") 2>&1
}

log_info() {
    echo "[$(date '+%Y-%m-%d %H:%M:%S')] [INFO]    $*"
}

log_warn() {
    echo "[$(date '+%Y-%m-%d %H:%M:%S')] [WARN]    $*"
}

log_error() {
    echo "[$(date '+%Y-%m-%d %H:%M:%S')] [ERROR]   $*"
}

log_success() {
    echo "[$(date '+%Y-%m-%d %H:%M:%S')] [SUCCESS] $*"
}

log_separator() {
    echo "=============================================================================="
}

# =============================================================================
# VALIDATION FUNCTIONS
# =============================================================================

check_root() {
    if [[ "$(id -u)" -ne 0 ]]; then
        log_error "This script must be run as root."
        log_error "Usage: sudo $0"
        exit 1
    fi
    log_info "Privilege check: running as root ✓"
}

check_xcode_installed() {
    log_info "Verifying if Xcode is installed..."
    if [[ ! -d "${APP_PATH}" ]]; then
        log_error "${APP_NAME} not found at ${APP_PATH}."
        log_error "Ensure the app was deployed via VPP before running this script."
        exit 1
    fi
    
    local version
    version=$(defaults read "${APP_PATH}/Contents/Info.plist" CFBundleShortVersionString 2>/dev/null || echo "unknown")
    log_info "${APP_NAME} found. Version: ${version} ✓"
}

# =============================================================================
# CONFIGURATION FUNCTIONS
# =============================================================================

configure_xcode() {
    log_info "Starting Xcode post-installation configuration..."

    # 1. Configure xcode-select
    log_info "Configuring xcode-select to the correct path..."
    if "${XCODESELECT_BIN}" -s "${APP_PATH}/Contents/Developer"; then
        log_info "Developer path configured ✓"
    else
        log_error "Failed to configure xcode-select."
        exit 1
    fi

    # 2. Accept the License (EULA)
    log_info "Accepting the Xcode license (EULA)..."
    if "${XCODEBUILD_BIN}" -license accept; then
        log_info "License accepted successfully ✓"
    else
        log_error "Failed to accept the license."
        exit 1
    fi

    # 3. Execute "First Launch" (Install packages, simulators, tools)
    # This prevents the end-user from getting an admin prompt
    log_info "Executing first launch (installing components)... This may take a while."
    if "${XCODEBUILD_BIN}" -runFirstLaunch; then
        log_info "First launch components installed successfully ✓"
    else
        log_error "Failed to install first launch components."
        exit 1
    fi

    # 4. Add _developer group for all users (Optional, but useful)
    # Allows command-line tools without sudo
    log_info "Enabling access to the developer group..."
    if dseditgroup -o edit -a everyone -t group _developer 2>/dev/null; then
        log_info "_developer group configured for 'everyone' ✓"
    else
        log_warn "Warning: Could not add 'everyone' to the _developer group."
    fi
    
    # Enable developer mode
    log_info "Enabling Developer Mode (DevToolsSecurity)..."
    if /usr/sbin/DevToolsSecurity -enable; then
        log_info "Developer Mode enabled ✓"
    else
        log_warn "Warning: Failed to enable Developer Mode."
    fi
}

verify_configuration() {
    log_info "Verifying configuration..."
    
    # Verify license
    if "${XCODEBUILD_BIN}" -checkFirstLaunchStatus 2>&1 | grep -q "not accepted"; then
        log_error "The license does not appear to be accepted."
        return 1
    fi
    
    # Verify path
    local current_path
    current_path=$("${XCODESELECT_BIN}" -p)
    if [[ "${current_path}" != "${APP_PATH}/Contents/Developer" ]]; then
        log_error "The xcode-select path is incorrect: ${current_path}"
        return 1
    fi

    log_success "Xcode configured correctly!"
    return 0
}

# =============================================================================
# MAIN EXECUTION
# =============================================================================

main() {
    setup_logging

    log_separator
    log_info "=== ${APP_NAME} Post-Installation Configuration ==="
    log_info "Script version: ${SCRIPT_VERSION}"
    log_info "Date/Time: $(date '+%Y-%m-%d %H:%M:%S %Z')"
    log_info "Hostname: $(hostname)"
    log_info "Executing user: $(whoami)"
    log_separator

    # Pre-checks
    check_root
    check_xcode_installed

    # Configuration
    configure_xcode

    # Final verification
    if verify_configuration; then
        log_separator
        log_success "=== Configuration completed successfully! ==="
        log_separator
        exit 0
    else
        log_separator
        log_error "=== Configuration failed! ==="
        log_separator
        exit 1
    fi
}

main "$@"