--dry-run still installs and still runs scripts
dryRun is checked in exactly one place — Sources/core/Managers/ManifestManager.swift:117, where it suppresses the download and logs [Dry Run] Would download <name>. There are no references to it in PackageManager, ScriptManager or IAOrchestrator.
Consequence: a dry run downloads nothing and then attempts every install and every script anyway, against whatever is (or is not) on disk. On a clean machine that means a run full of failures against missing files; on a machine with stale payloads in place it means a dry run that actually installs software. The flag's help text says it performs no installer actions, so an admin reasonably uses it to rehearse a manifest against a real device.
Fix: check dryRun at each action site — package install, root script, user script — and log what would have happened instead of doing it. If the flag is only ever meant to validate that the document decodes and the stage/item list is right, then it needs a name and help text that say so.
--dry-runstill installs and still runs scriptsdryRunis checked in exactly one place —Sources/core/Managers/ManifestManager.swift:117, where it suppresses the download and logs[Dry Run] Would download <name>. There are no references to it inPackageManager,ScriptManagerorIAOrchestrator.Consequence: a dry run downloads nothing and then attempts every install and every script anyway, against whatever is (or is not) on disk. On a clean machine that means a run full of failures against missing files; on a machine with stale payloads in place it means a dry run that actually installs software. The flag's help text says it performs no installer actions, so an admin reasonably uses it to rehearse a manifest against a real device.
Fix: check
dryRunat each action site — package install, root script, user script — and log what would have happened instead of doing it. If the flag is only ever meant to validate that the document decodes and the stage/item list is right, then it needs a name and help text that say so.