larvit/plainpages
3
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

Run the E2E runner as the invoking user so its artifacts aren't root-owned #62

Merged
lilleman merged 4 commits from e2e-artifact-ownership into main 2026-08-05 23:04:19 +02:00
Conversation 0 Commits 4 Files Changed 14
+9 -6
2 changed files with 9 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Showing only changes of commit 78f5f72151 - Show all commits
AGENTS.md
+4 -2
View File
@@ -226,8 +226,10 @@ Revisit only if the stated reason stops holding.
files, `.dockerignore` the image). files, `.dockerignore` the image).
- **A container whose output a human then edits or deletes runs as `--user "$(id -u):$(id -g)"`** — - **A container whose output a human then edits or deletes runs as `--user "$(id -u):$(id -g)"`** —
the E2E runner (artifacts) and a lockfile edit, or the output is root-owned and needs `sudo`, which the E2E runner (artifacts) and a lockfile edit, or the output is root-owned and needs `sudo`, which
a dev box may not have at all. Not universal: `bootstrap` writes `jwks.json` as root on a first a dev box may not have at all. Not universal: `bootstrap` writes `jwks.json` as root when it is
boot, and a generated signing key is the operator's to leave alone. Three consequences. absent on first boot — the committed dev key makes that rare, and when it happens the rotation
runbook's host-side `>` needs the file re-owned first. Valid while the dev key ships committed.
Three consequences.
`e2e-tests/artifacts/` is *tracked* (`.gitkeep`), since an absent bind-mount source is `e2e-tests/artifacts/` is *tracked* (`.gitkeep`), since an absent bind-mount source is
daemon-created as root and that uid then cannot write it — which also makes a root-owned leftover daemon-created as root and that uid then cannot write it — which also makes a root-owned leftover
an upgrade hazard (README → Breaking changes). The runner image sets `HOME=/tmp`, since an an upgrade hazard (README → Breaking changes). The runner image sets `HOME=/tmp`, since an
README.md
+5 -4
View File
@@ -1775,12 +1775,13 @@ so for now the error names the rule it tripped instead.
silently shadows the image's deps. silently shadows the image's deps.
- **`e2e-tests/artifacts/` is tracked, and the E2E runner writes as you** (2026-08-05). A root-owned - **`e2e-tests/artifacts/` is tracked, and the E2E runner writes as you** (2026-08-05). A root-owned
leftover from an earlier run blocks the checkout of its `.gitkeep` — git reports the failure but leftover from an earlier run blocks the checkout of its `.gitkeep` — git reports the failure but
still exits 0, leaving the file staged as deleted — and every E2E suite then fails `EACCES`. Clear still exits 0, leaving the file deleted in your working tree, where a later `git commit -a` would
it before pulling; a root container does what `sudo` would, which this needs and a dev box may lack: commit that deletion — and every E2E suite then fails `EACCES`. Clear it before pulling; a root
container does what `sudo` would, which this needs and a dev box may lack:
```bash ```bash
docker run --rm -v "$PWD/e2e-tests:/x" alpine:3.23 rm -rf /x/artifacts docker run --rm -v "$PWD/e2e-tests:/x" node:24.19.0-alpine3.24 rm -rf /x/artifacts
git checkout -- e2e-tests/artifacts/.gitkeep git checkout -- e2e-tests/artifacts/.gitkeep # only if a pull already deleted it
``` ```
## Observability ## Observability