End-to-end (security)

Matrix: name: security, shard: security

Failed

The runner's container stopped before the job finished, without an exit code (the platform restarted or replaced it).

Set up job

Diffinery runner: job e2e (End-to-end (security)) for codician/diffinery@142f6dac6b62Runner: image diffinery-runner:4d3bf17f06575e64ab4155b3, in cdg15, WEUR, container d406d55e5183f45ef8af65aa0a7fe65455956cc1a665fe408c3bc0b5d3cf4e80Runner size: large (4 vCPU, 12 GiB of memory, 20 GB of disk), an earlier run of this job wasn't measured; runs-on: diffinery-large (or -medium, -small, -tiny) sets a sizeHost: AMD EPYC (family 25, model 17), 4 vCPUs, 2550 MHzWorkspace: /workspace/diffinery

Run actions/checkout@v41s

##[group]Run actions/checkout@v4##[endgroup]Syncing repository: codician/diffineryFetching the repository (depth 1)remote: Enumerating objects: 785, done.        Receiving objects:   0% (1/785)
Receiving objects:   1% (8/785)
Receiving objects:   2% (16/785)
Receiving objects:   3% (24/785)
Receiving objects:   4% (32/785)
Receiving objects:   5% (40/785)
Receiving objects:   6% (48/785)
Receiving objects:   7% (55/785)
Receiving objects:   8% (63/785)
Receiving objects:   9% (71/785)
Receiving objects:  10% (79/785)
Receiving objects:  11% (87/785)
Receiving objects:  12% (95/785)
Receiving objects:  13% (103/785)
Receiving objects:  14% (110/785)
Receiving objects:  15% (118/785)
Receiving objects:  16% (126/785)
Receiving objects:  17% (134/785)
Receiving objects:  18% (142/785)
Receiving objects:  19% (150/785)
Receiving objects:  20% (157/785)
Receiving objects:  21% (165/785)
Receiving objects:  22% (173/785)
Receiving objects:  23% (181/785)
Receiving objects:  24% (189/785)
Receiving objects:  25% (197/785)
Receiving objects:  26% (205/785)
Receiving objects:  27% (212/785)
Receiving objects:  28% (220/785)
Receiving objects:  29% (228/785)
Receiving objects:  30% (236/785)
Receiving objects:  31% (244/785)
Receiving objects:  32% (252/785)
Receiving objects:  33% (260/785)
Receiving objects:  34% (267/785)
Receiving objects:  35% (275/785)
Receiving objects:  36% (283/785)
Receiving objects:  37% (291/785)
Receiving objects:  38% (299/785)
Receiving objects:  39% (307/785)
Receiving objects:  40% (314/785)
Receiving objects:  41% (322/785)
Receiving objects:  42% (330/785)
Receiving objects:  43% (338/785)
Receiving objects:  44% (346/785)
Receiving objects:  45% (354/785)
Receiving objects:  46% (362/785)
Receiving objects:  47% (369/785)
Receiving objects:  48% (377/785)
Receiving objects:  49% (385/785)
Receiving objects:  50% (393/785)
Receiving objects:  51% (401/785)
Receiving objects:  52% (409/785)
Receiving objects:  53% (417/785)
Receiving objects:  54% (424/785)
Receiving objects:  55% (432/785)
Receiving objects:  56% (440/785)
Receiving objects:  57% (448/785)
Receiving objects:  58% (456/785)
Receiving objects:  59% (464/785)
Receiving objects:  60% (471/785)
Receiving objects:  61% (479/785)
Receiving objects:  62% (487/785)
Receiving objects:  63% (495/785)
Receiving objects:  64% (503/785)
Receiving objects:  65% (511/785)
Receiving objects:  66% (519/785)
Receiving objects:  67% (526/785)
Receiving objects:  68% (534/785)
Receiving objects:  69% (542/785)
Receiving objects:  70% (550/785)
Receiving objects:  71% (558/785)
Receiving objects:  72% (566/785)
Receiving objects:  73% (574/785)
Receiving objects:  74% (581/785)
Receiving objects:  75% (589/785)
Receiving objects:  76% (597/785)
Receiving objects:  77% (605/785)
Receiving objects:  78% (613/785)
Receiving objects:  79% (621/785)
Receiving objects:  80% (628/785)
Receiving objects:  81% (636/785)
Receiving objects:  82% (644/785)
Receiving objects:  83% (652/785)
Receiving objects:  84% (660/785)
Receiving objects:  85% (668/785)
Receiving objects:  86% (676/785)
Receiving objects:  87% (683/785)
Receiving objects:  88% (691/785)
Receiving objects:  89% (699/785)
Receiving objects:  90% (707/785)
Receiving objects:  91% (715/785)
Receiving objects:  92% (723/785)
Receiving objects:  93% (731/785)
Receiving objects:  94% (738/785)
Receiving objects:  95% (746/785)
Receiving objects:  96% (754/785)
Receiving objects:  97% (762/785)
remote: Total 785 (delta 0), reused 785 (delta 0)        Receiving objects:  98% (770/785)
Receiving objects:  99% (778/785)
Receiving objects: 100% (785/785)
Receiving objects: 100% (785/785), 3.59 MiB | 11.21 MiB/s, done.From https://diffinery.com/codician/diffinery * [new ref]         142f6dac6b626f63a83d2090699c1101219b306d -> origin/diffinery-checkoutNote: switching to '142f6dac6b626f63a83d2090699c1101219b306d'.You are in 'detached HEAD' state. You can look around, make experimentalchanges and commit them, and you can discard any commits you make in thisstate without impacting any branches by switching back to a branch.If you want to create a new branch to retain commits you create, you maydo so (now or later) by using -c with the switch command. Example:  git switch -c <new-branch-name>Or undo this operation with:  git switch -Turn off this advice by setting config variable advice.detachedHead to falseHEAD is now at 142f6da Merge 6022b3d579ff00127f4e8ccd9889f49a5fbed626 into 683b739beb0ea3e50cf58e3a579f825990056406HEAD is now at 142f6dac6b626f63a83d2090699c1101219b306d

Run pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b12s

Download action repository 'pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1'##[group]Run pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1with:  dest: ~/setup-pnpm  run_install: null  cache: false  cache_dependency_path: pnpm-lock.yaml  package_json_file: package.json  standalone: false##[endgroup]##[group]Running self-installer...Progress: resolved 1, reused 0, downloaded 0, added 0Packages: +1+Progress: resolved 1, reused 0, downloaded 1, added 1, donedependencies:+ pnpm 10.28.0 (12.15.0 is available)Done in 955ms##[endgroup]Installation Completed!

Run actions/setup-node@v46s

##[group]Run actions/setup-node@v4with:  node-version: 22  cache: pnpm##[endgroup]Found in cache @ 22.22.0 (pre-installed node satisfies '22')Cache Size: ~216 MB (226934503 B)Cache restored from key: node-cache-Linux-x64-pnpm-42d02c0263a3b5f911ed6ae8e9210922b97166ca02e60b2c70c55dfa1f00371b

Run pnpm install --frozen-lockfile3s

##[group]Run pnpm install --frozen-lockfile##[endgroup]Scope: all 8 workspace projectsLockfile is up to date, resolution step is skippedProgress: resolved 1, reused 0, downloaded 0, added 0Packages: +251++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++Progress: resolved 251, reused 245, downloaded 0, added 237Progress: resolved 251, reused 245, downloaded 0, added 251, done.../esbuild@0.28.1/node_modules/esbuild postinstall$ node install.js.../esbuild@0.25.12/node_modules/esbuild postinstall$ node install.js.../node_modules/workerd postinstall$ node install.js.../esbuild@0.25.11/node_modules/esbuild postinstall$ node install.js.../node_modules/workerd postinstall$ node install.js.../esbuild@0.28.1/node_modules/esbuild postinstall: Done.../esbuild@0.28.2/node_modules/esbuild postinstall$ node install.js.../esbuild@0.25.12/node_modules/esbuild postinstall: Done.../node_modules/workerd postinstall: Done.../esbuild@0.25.11/node_modules/esbuild postinstall: Done.../node_modules/workerd postinstall: Done.../esbuild@0.28.2/node_modules/esbuild postinstall: DonedevDependencies:+ turbo 2.11.7+ typescript 5.9.3Done in 2.9s using pnpm v10.28.0

Run pnpm -r --if-present build1s

##[group]Run pnpm -r --if-present build##[endgroup]Scope: 7 of 8 workspace projectsapps/cli build$ esbuild src/bin.ts --bundle --platform=node --target=node22 --format=esm --outfile=dist/diffinery.mjs "--banner:js=#!/usr/bin/env nodeimport { createRequire as __diffineryCreateRequire } from 'node:module'; const require = __diffineryCreateRequire(import.meta.url);"apps/diffinery build$ node islands/build.mjs && node scripts/build-docs.mjscontainers/runner build$ esbuild src/main.ts --bundle --platform=node --target=node22 --format=esm --outfile=dist/agent.mjs --external:bufferutil --external:utf-8-validate "--banner:js=import { createRequire as __diffineryCreateRequire } from 'node:module'; const require = __diffineryCreateRequire(import.meta.url);"apps/cli build:   dist/diffinery.mjs  465.9kbapps/cli build: ⚡ Done in 44msapps/cli build: Donecontainers/runner build:   dist/agent.mjs  684.1kbcontainers/runner build: ⚡ Done in 73mscontainers/runner build: Doneapps/diffinery build: islands: kumo.js 466 KB, kumo.css 149 KB, terminal.js 286 KBapps/diffinery build: docs: 75 pages (+2 generated at runtime), 10 site pages, 11 images, CLI 0.1.0 (248 KiB), editor extension 0.1.1 (20 KiB), JetBrains plugin 0.1.0 (64 KiB), Claude Code plugins diffinery 0.1.1, diffinery-ci 0.2.1apps/diffinery build: Done

Run pnpm --filter @diffinery/app exec playwright install --with-deps chromium

Run as_root() { if [ "$(id -u)" = 0 ]; then "$@"; else sudo "$@"; fi; }

Run the shard's tests74h 50m

##[group]Run # Shards of similar length; a new test file runs in "rest" unless it's added to another.core='/e2e\.test\.mjs$'agents='/(agentic|review|tasks)\.test\.mjs$'# security.test.mjs, security-*.test.mjs (security-txt's too) and status.test.mjs.security='/(security(-[a-z-]+)?|status)\.test\.mjs$'# The core file's real histories and large pushes take minutes each (jquery's alone 2 to 3 on# Diffinery's runners): two shards of their own, so no part of the file runs into node's# per-file timeout, which is the --test-timeout here.histories='^real histories:'large='^(large files|large pushes):'opts=(--test-timeout=600000)case "security" in  core) files=$(ls test/e2e/*.test.mjs | grep -E "$core"); opts+=(--test-skip-pattern="$histories" --test-skip-pattern="$large") ;;  histories) files=$(ls test/e2e/*.test.mjs | grep -E "$core"); opts=(--test-timeout=900000 --test-name-pattern="$histories") ;;  large) files=$(ls test/e2e/*.test.mjs | grep -E "$core"); opts+=(--test-name-pattern="$large") ;;  agents) files=$(ls test/e2e/*.test.mjs | grep -E "$agents") ;;  security) files=$(ls test/e2e/*.test.mjs | grep -E "$security") ;;  *) files=$(ls test/e2e/*.test.mjs | grep -vE "$core|$agents|$security") ;;esacecho "$files"# Two files at a time: each starts its own local server on its own port, database and# directory, so they don't share state, and a file's server mostly keeps one core busy.node --test --test-concurrency=2 "${opts[@]}" $files##[endgroup]test/e2e/security-limits.test.mjstest/e2e/security-txt.test.mjstest/e2e/security.test.mjstest/e2e/status.test.mjsTAP version 13# Subtest: security: environment reviewers hold a deploy job until a listed person approves, and nobody else canok 1 - security: environment reviewers hold a deploy job until a listed person approves, and nobody else can  ---  duration_ms: 31948.462232  type: 'test'  ...# Subtest: security: adding someone by username sends an invitation, and they get access only once they acceptok 2 - security: adding someone by username sends an invitation, and they get access only once they accept  ---  duration_ms: 1224.954054  type: 'test'  ...# Subtest: security: per-account quotas on hosted minutes, hosted jobs at once, sandboxes and repositoriesok 3 - security: per-account quotas on hosted minutes, hosted jobs at once, sandboxes and repositories  ---  duration_ms: 62809.574946  type: 'test'  ...# Subtest: security: a per-account storage quota refuses pushes, Git LFS and release asset uploads past it; reads and deletes keep workingok 4 - security: a per-account storage quota refuses pushes, Git LFS and release asset uploads past it; reads and deletes keep working  ---  duration_ms: 3402.9086  type: 'test'  ...# Subtest: security: kill switches suspend Actions for a repository or an account, and pause hosted compute on the instanceok 5 - security: kill switches suspend Actions for a repository or an account, and pause hosted compute on the instance  ---  duration_ms: 17804.105016  type: 'test'  ...# Subtest: security: Markdown images from other sites load through Diffinery's signed image proxyok 6 - security: Markdown images from other sites load through Diffinery's signed image proxy  ---  duration_ms: 255.798278  type: 'test'  ...# Subtest: security.txt: every RFC 9116 field with SECURITY_CONTACT setok 7 - security.txt: every RFC 9116 field with SECURITY_CONTACT set  ---  duration_ms: 17247.567441  type: 'test'  ...# Subtest: security reports: security.txt names the form, and an anonymous report needs a reply-to addressok 8 - security reports: security.txt names the form, and an anonymous report needs a reply-to address  ---  duration_ms: 5425.572475  type: 'test'  ...# Subtest: security reports: a signed-in report replies to the account's addressok 9 - security reports: a signed-in report replies to the account's address  ---  duration_ms: 64.214104  type: 'test'  ...# Subtest: security reports: only site administrators can see them (404 for anyone else)ok 10 - security reports: only site administrators can see them (404 for anyone else)  ---  duration_ms: 123.213105  type: 'test'  ...# Subtest: security reports: each new report emails the site administrators, and only themok 11 - security reports: each new report emails the site administrators, and only them  ---  duration_ms: 1045.889422  type: 'test'  ...# Subtest: security reports: triage and resolve, on the web and through the API, auditedok 12 - security reports: triage and resolve, on the web and through the API, audited  ---  duration_ms: 95.268771  type: 'test'  ...

codician/diffinerypublic

End-to-end (security)