How to run cfscript.sh unattended

Short answer: yes, you can solve this without tampering with the cfsetup.sh script or weakening the security model.
How?
My suggestion is as follows:

• Run cfsetup.sh as root via a tightly scoped sudo rule (NOPASSWD for that exact command only, and no wildcards). If the caller is root, then su will not prompt for a password, which is why no script edit will be necessary.
• Give your GitLab runner a dedicated service account for this, not shared admin access.

​@dkgcb , while I don’t work for Adobe (and don’t claim to know ALL the details), I will offer this.

As you may know, the cfsetup command/script simply reads or updates the various neo*.xml files that underlie CF admin configuration, as found in the cfusion/lib (or instancename/lib) folder. As such, whoever runs it does have to have the authority to edit those files.

Normally, a linux install of CF runs CF as “nobody”--and sets up the various cf folders to be owned by that user and the “bin” group. When you’re at the commandline running cfsetup, you’re usually “somebody” else--and so I suspect the tool doesn’t presume (or perhaps doesn’t detect that) you have the authority to edit those files, so it prompts for a password. 

So back to your removing the su prefix, if that “works” for your requests, then I’d not presume there to be any “security implication” other than that now anyone who can get to the commandline can run that cfsetup without any password prompt required. Then again, they’d need for their user to have the authority to edit those neo*.xml files, so I don’t see this “opening a hole”. The tool just makes it “easier” to manage such admin settings via such automation (via its available commands or the json file it supports exporting/importing).

If you may still have doubts after this, and assuming no one else offers better insights, I’d recommend you send your question to cfinstal@adobe.com, which offers free support for such setup questions. If you get some useful answer from them, I hope you will please pass it along here. (There’s no guarantee someone from Adobe will see this post here, though they may.)