To install an apple via headless, first update:

sudo softwareupdate -iaR

Then configure ssh to only accept public-keys:

sudo vim /etc/ssh/sshd_config

Ensure you have this:

PasswordAuthentication no
ChallengeResponseAuthentication no

Reboot, test and then install homebrew:

/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"

Create a Brewfile

$ cat $HOME/Brewfile
brew "gmp"
brew "libyaml"
brew "tmux"
brew "ssh-vault"

Install with brew bundle

Create a user for Github Actions (runner)

sudo dscl . -create /Users/gh-runner
sudo dscl . -create /Users/gh-runner UserShell /bin/zsh
sudo dscl . -create /Users/gh-runner RealName "GitHub runner"
sudo dscl . -create /Users/gh-runner UniqueID "1001"
sudo dscl . -create /Users/gh-runner PrimaryGroupID 20
sudo dscl . -create /Users/gh-runner NFSHomeDirectory /Users/gh-runner
# change password
sudo dscl . -passwd /Users/gh-runner secret
sudo dscl . -append /Groups/admin GroupMembership gh-runner
sudo createhomedir -c

Test:

su - gh-runner