CI pin runs tests as root and leaves root-owned checkout artifacts #40
Breadway
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Found investigating exact-head PR22 check run134 at
a3e1854. Confidence high: ci/bread-ecosystem.rev pins147cfbbf96ae4b171027defa1130d2caddb934b1 whose shared ci/build.sh docker run has no --user, so chmod permission regressions cannot exercise unreadable directories/eviction failures. Logs show both new regressions failing their explicit unprivileged-runner assertions after clippy/build success. Finally cleanup also fails unlinkat src/target/.rustc_info.json permission denied, consistent with root-owned copied artifacts. Update pin to an integrated independently accepted shared CI revision with unprivileged execution and correct writable mounts; retain permission regressions and verify exact-head CI. Logs https://git.breadway.dev/Breadway/bread/actions/runs/134/jobs/0/attempt/1/logs . No remote permissions/storage modifications authorized.Updated existing PR22 at2b641bb4213c6ae1631f414953a9dd7783afd28c: ci/bread-ecosystem.rev now pins integrated main merge25bf3af49a3de240f64ed90e6eebd2958e672d10 (shared CI PR55), which includes unprivileged docker --user, bind-mounted writable caches, passwd/group lookup and per-product locking. No permission tests skipped or weakened; no remote cleanup/permissions changes made. Fresh push starts exact-head CI. Prior root-owned runner checkout may still need authorized operator repair if subsequent checkout cleanup fails; do not silently change remote permissions.
Exact head2b641bb4213c6ae1631f414953a9dd7783afd28c passes full414 workspace tests locally, workspace all-target clippy -D warnings, fmt and docs. Exact-head Actions run135/job0 currently pending. Independent review of
a3e1854previously passed all scoped BREAD40 criteria; pin-only change still requires current-head review and CI before acceptance.Exact-head2b641bb4213c6ae1631f414953a9dd7783afd28c review BLOCKED: #22 (comment). Immutable integrated sharedPR55 merge25bf3af pin verified: --user invoking uid/gid, host-writable bind caches, passwd/group and per-product locks; bash syntax pass. Oldrun134 logs independently confirm both root permission assertion failures and cleanup permission error. Newrun135 unreadable test passes, no final cleanup error observed, but workflow fails eviction regression line214 left0/right1. Required successful runner validation not yet available. Repair BREAD40 test, fresh green exact-head CI and review; no remote artifact cleanup/permissions changes authorized or performed. PR21 unmerged/blocked and broader BREAD14 acceptance unresolved. Keep review; no merge/retarget/done.
Independent exact-head74d436e098603bf451b6f60fcdb7bfef8b07948f review BLOCKED, full criterion evidence #22 (comment).14-line test-only repair establishes pad victim mtime UNIX_EPOCH and asserts read-back older than clip before chmod0500. No sleeps/skips or weaker error/no-new-record/cap checks. Prior eviction regression rejection resolved;28 crate tests, crate all-target clippy -D warnings and fmt independently pass uid1000. Store and integrated CI pin unchanged from prior reviews. Exact-head check / check (push) PENDING Actions136/job0 id2416; available logs clippy/build complete, no final workflow/cleanup result yet. One snapshot, no polling loop. PR21 unmerged/blocked and broader BREAD14 acceptance unresolved. Keep review, no merge/retarget/done or remote access. Durable session updated blocked current SHA. Next obtain completed CI result, repair genuine failures if any, fresh review if SHA changes. Evidence /tmp/opencode/review-bread40-41-74d436e/.
Independent exact-head review PASS at
1505b0d445. Criterion mapping and evidence: #22 (comment) . Required check / check (push) success, Actions run 141 job 2446, every step success including Complete job. Re-read head1505b0dand base4a164fdimmediately before merge. Merged=true, merge SHAaea9879d61. feature/breadbug-store kept for stacked PR23. This is not done: leave review. Two-pass consumer verification happens on main after PR23. If breadboard sync auto-closes this card, restore review; known server limitation.Integrated verification on descendant main merge6699643099a82023ab1334b2e1bd0304b8e9d862: clean worktree cargo test --locked -p bread-bug -p breadbug --lib passed47+11, including strict total caps, lowered caps/reopen, failed eviction/unreadable accounting, exclusions and wipe. cargo test --locked -p breadd --test ipc_integration bug_store_survives passed2 real-daemon restart/module-reload tests with store health and noncolliding markers. PR22 independent pass comment4597; PR23 composition pass4672. CI unprivileged pin and checkout cleanup verified in PR22 run141; integrated dev-release at6699643 success.