inetum-poland/Jamf Recovery Lock Rotation
GitHub Action for macOS Recovery Lock rotation in Jamf Pro with secure passphrase generation and no infrastructure required.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| jamf_url | Jamf Pro base URL (e.g. https://example.jamfcloud.com) | yes | — |
| rotation_scope | "all" for every computer with a Management ID in inventory, or the exact Smart Computer Group name for a scoped run. | no | all |
| clear_passwords | If true, skip the wordlist and send SET_RECOVERY_LOCK with an empty newPassword (clears Recovery Lock). Works with dry_run for simulation. Default false. | no | false |
| dry_run | If true, log intended actions without calling the MDM API. | no | false |
| show_passwords_in_dry_run | When DRY_RUN is true, log extra detail at WARN: passphrases when rotating, or management IDs when clearing Recovery Lock. Ignored when dry_run is false. | no | false |
| log_level | Logging verbosity: debug, info, warn, or error. | no | info |
| wordlist | Bundled wordlist relative to the action root (e.g. wordlists/eff_short_wordlist_1.txt). Use this from any consumer workflow to pick a file shipped inside the action. Ignored when wordlist_path is set. If both are empty, the script default (bundled eff_large_wordlist.txt) is used. | no | "" |
| wordlist_path | Absolute path to a wordlist on the runner. Use for a file in the caller repository after actions/checkout (for example pass the workflow expression that resolves to github.workspace plus a relative path). Takes precedence over wordlist. Leave both empty for the script default (bundled eff_large_wordlist.txt). | no | "" |
| word_count | Number of words per passphrase. | no | 4 |
| delimiter | Character(s) joining words in the passphrase. | no | - |
| inventory_id_batch_size | Max Jamf computer IDs per v3 inventory request when resolving Smart group membership (RSQL id=in=(…)). | no | 80 |
Outputs
| name | description |
|---|---|
| rotated_count | Number of devices for which SET_RECOVERY_LOCK was issued (or simulated in dry run). |
| failed_count | Number of devices skipped or that failed during rotation. |