Docs/pl 241 macos host hardening updates (#1248)

* remove unnecessary infos and rename the script

* change curl command output

* docs(release-notes): add macOS guest VM and host hardening notes to 3.31.0

Note that guest build VM images are hardened by default, and that a
host hardening guide and harden-macos-host.sh script are available for
self-hosted users.

Author: burakberkkeskin

docs/release-notes.md

@@ -83,6 +83,8 @@ import RedisDomainCaution from '@site/docs/self-hosted-appcircle/install-server/
 - A UI improvement has been made on the Apple Profiles list regarding an incorrect name. <SigningIdentitiesBadge/> <CloudBadge/> <SelfHostedBadge/>
 - Character limitations and validation checks have been implemented for Publish and Build Variable Group key values on the UI. <EnvironmentVariablesBadge/> <CloudBadge/> <SelfHostedBadge/>
 - The [Appcircle Standard macOS Pool (arm64)](/infrastructure/ios-build-infrastructure) has the latest RC release of Xcode 26.6 installed on runners. We strongly recommend extensive testing of your workflows to ensure compatibility and stability with this release. <InfrastructureBadge/> <CloudBadge/>
+- Appcircle macOS build VM (guest) images are now hardened by default. The disposable runner VM images apply a SIP-safe security and debloat baseline that lowers idle CPU/RAM usage and outbound telemetry while keeping Xcode, code signing, and notarization fully functional. No action is required to benefit from this change. <InfrastructureBadge/> <CloudBadge/> <SelfHostedBadge/>
+- A [macOS host hardening](/self-hosted-appcircle/self-hosted-runner/configure-runner/macos-host-hardening) guide and `harden-macos-host.sh` script have been added for self-hosted users to apply a safe security baseline to the physical macOS machine that runs their build VMs. Based on a subset of the CIS macOS Level 1 benchmark, the script tightens the firewall, login window, sharing services, and telemetry without breaking runner connectivity or code signing. <InfrastructureBadge/> <SelfHostedBadge/>
 
 ### 🐞 Fixes
 

docs/self-hosted-appcircle/self-hosted-runner/configure-runner/macos-host-hardening.md

@@ -1,6 +1,6 @@
 ---
 title: Hardening the macOS Host
-description: Use the harden-host.sh script to apply a safe security baseline to the physical macOS machine that runs your Appcircle self-hosted runner VMs.
+description: Use the harden-macos-host.sh script to apply a safe security baseline to the physical macOS machine that runs your Appcircle self-hosted runner VMs.
 tags:
   [
     self-hosted runner,
@@ -15,7 +15,7 @@ sidebar_position: 6
 
 When you run iOS builds on a self-hosted runner, the physical macOS machine (the host) runs your build VMs with Tart. The host is long-lived and reachable on your network, so it is the part of the setup worth securing first. The build VMs are disposable and re-created for each build.
 
-The `harden-host.sh` script applies a safe security baseline to that host. It is based on a subset of the CIS macOS Level 1 benchmark and is designed not to break your runner's connectivity.
+The `harden-macos-host.sh` script applies a safe security baseline to that host. It is based on a subset of the CIS macOS Level 1 benchmark and is designed not to break your runner's connectivity.
 
 This page explains what the script does, why it does it, and how to run it.
 
@@ -62,11 +62,11 @@ Restrict it instead of turning it off: limit access to trusted users and reach t
 
 ## Download the Script
 
-On the host, download `harden-host.sh` from the Appcircle CDN and make it executable:
+On the host, download `harden-macos-host.sh` from the Appcircle CDN and make it executable:
 
 ```bash
-curl -fsSL https://cdn.appcircle.io/self-hosted/harden-macos-host.sh -o harden-host.sh && \
-  chmod +x harden-host.sh
+curl -fsSL -O https://cdn.appcircle.io/self-hosted/harden-macos-host.sh  && \
+  chmod +x harden-macos-host.sh
 ```
 
 ## How to Use It
@@ -76,45 +76,38 @@ Run the script as an administrator on the host. It supports three modes.
 Review the current security posture without changing anything:
 
 ```bash
-sudo ./harden-host.sh --audit-only
+sudo ./harden-macos-host.sh --audit-only
 ```
 
 Preview the exact changes the script would make, without applying them:
 
 ```bash
-sudo ./harden-host.sh --dry-run
+sudo ./harden-macos-host.sh --dry-run
 ```
 
 Apply the baseline:
 
 ```bash
-sudo ./harden-host.sh
+sudo ./harden-macos-host.sh
 ```
 
 To apply the baseline and also disable Remote Login:
 
 ```bash
-sudo ./harden-host.sh --disable-ssh
+sudo ./harden-macos-host.sh --disable-ssh
 ```
 
-:::caution
-
-Run `--audit-only` first and review the report. If SIP, FileVault, or Gatekeeper is reported as off, enable it before relying on the host for production builds.
-
-:::
-
 Some changes (limiting ad tracking and disabling the Siri, Apple Intelligence, and suggestion agents) apply to a specific user account. The script uses the account that invoked `sudo`, falling back to the current console user. To target a different account, set `ADMIN_USER`:
 
 ```bash
-sudo ADMIN_USER=ci-admin ./harden-host.sh
+sudo ADMIN_USER=ci-admin ./harden-macos-host.sh
 ```
 
 ## What You Still Need to Do Manually
 
 A few protections cannot be enabled from a script and require your action:
 
 - **SIP:** If reported as disabled, re-enable it from recoveryOS with `csrutil enable`.
-- **FileVault:** If reported as off, enable full-disk encryption and store the recovery key safely (ideally through your MDM). For unattended reboots, use `fdesetup authrestart` so the host can come back online without someone entering the password at the screen.
 
 ## After Running the Script
 
@@ -124,9 +117,3 @@ Confirm the host is still reachable and the runner still works:
 - Run a test build to confirm the runner connects and completes a job.
 
 Re-run the script (or at least re-check the audit report) after every macOS update, because updates can reset some of these settings.
-
-## Managing a Fleet with MDM
-
-The script is a good fit for a single host or for preparing a host before it joins a managed fleet. For several hosts, the more durable approach is to enroll them in a Mobile Device Management (MDM) solution and push the security settings as a configuration profile. Profile-based settings are enforced and cannot be removed locally, which keeps every host consistent.
-
-The recommended baseline for this is a CIS Level 1 profile generated with the macOS Security Compliance Project (mSCP), with SSH left enabled for runner access.