End-to-end (security)
took 4m 2s Raw logs
Matrix: name: security, shard: security
Failed
The runner's container stopped before the job finished, without an exit code (the platform restarted or replaced it).
Set up job
Diffinery runner: job e2e (End-to-end (security)) for codician/diffinery@36263e52cb30Runner: image diffinery-runner:4d3bf17f06575e64ab4155b3, in cdg08, WEUR, container 457993dba85e1d94d1065f75c41cdc4b04e07ff3d35941a263af982dc8df615cRunner size: large (4 vCPU, 12 GiB of memory, 20 GB of disk), this job uses what a smaller runner doesn't have; runs-on: diffinery-large (or -medium, -small, -tiny) sets a sizeHost: AMD EPYC (family 25, model 1), 4 vCPUs, 2000 MHzWorkspace: /workspace/diffinery
Run actions/checkout@v41s
##[group]Run actions/checkout@v4##[endgroup]Syncing repository: codician/diffineryFetching the repository (depth 1)remote: Enumerating objects: 875, done. Receiving objects: 0% (1/875) Receiving objects: 1% (9/875) Receiving objects: 2% (18/875) Receiving objects: 3% (27/875) Receiving objects: 4% (35/875) Receiving objects: 5% (44/875) Receiving objects: 6% (53/875) Receiving objects: 7% (62/875) Receiving objects: 8% (70/875) Receiving objects: 9% (79/875) Receiving objects: 10% (88/875) Receiving objects: 11% (97/875) Receiving objects: 12% (105/875) Receiving objects: 13% (114/875) Receiving objects: 14% (123/875) Receiving objects: 15% (132/875) Receiving objects: 16% (140/875) Receiving objects: 17% (149/875) Receiving objects: 18% (158/875) Receiving objects: 19% (167/875) Receiving objects: 20% (175/875) Receiving objects: 21% (184/875) Receiving objects: 22% (193/875) Receiving objects: 23% (202/875) Receiving objects: 24% (210/875) Receiving objects: 25% (219/875) Receiving objects: 26% (228/875) Receiving objects: 27% (237/875) Receiving objects: 28% (245/875) Receiving objects: 29% (254/875) Receiving objects: 30% (263/875) Receiving objects: 31% (272/875) Receiving objects: 32% (280/875) Receiving objects: 33% (289/875) Receiving objects: 34% (298/875) Receiving objects: 35% (307/875) Receiving objects: 36% (315/875) Receiving objects: 37% (324/875) Receiving objects: 38% (333/875) Receiving objects: 39% (342/875) Receiving objects: 40% (350/875) Receiving objects: 41% (359/875) Receiving objects: 42% (368/875) Receiving objects: 43% (377/875) Receiving objects: 44% (385/875) Receiving objects: 45% (394/875) Receiving objects: 46% (403/875) Receiving objects: 47% (412/875) Receiving objects: 48% (420/875) Receiving objects: 49% (429/875) Receiving objects: 50% (438/875) Receiving objects: 51% (447/875) Receiving objects: 52% (455/875) Receiving objects: 53% (464/875) Receiving objects: 54% (473/875) Receiving objects: 55% (482/875) Receiving objects: 56% (490/875) Receiving objects: 57% (499/875) Receiving objects: 58% (508/875) Receiving objects: 59% (517/875) Receiving objects: 60% (525/875) Receiving objects: 61% (534/875) Receiving objects: 62% (543/875) Receiving objects: 63% (552/875) Receiving objects: 64% (560/875) Receiving objects: 65% (569/875) Receiving objects: 66% (578/875) Receiving objects: 67% (587/875) Receiving objects: 68% (595/875) Receiving objects: 69% (604/875) Receiving objects: 70% (613/875) Receiving objects: 71% (622/875) Receiving objects: 72% (630/875) Receiving objects: 73% (639/875) Receiving objects: 74% (648/875) Receiving objects: 75% (657/875) Receiving objects: 76% (665/875) Receiving objects: 77% (674/875) Receiving objects: 78% (683/875) Receiving objects: 79% (692/875) Receiving objects: 80% (700/875) Receiving objects: 81% (709/875) Receiving objects: 82% (718/875) Receiving objects: 83% (727/875) Receiving objects: 84% (735/875) Receiving objects: 85% (744/875) Receiving objects: 86% (753/875) Receiving objects: 87% (762/875) Receiving objects: 88% (770/875) Receiving objects: 89% (779/875) Receiving objects: 90% (788/875) Receiving objects: 91% (797/875) Receiving objects: 92% (805/875) Receiving objects: 93% (814/875) Receiving objects: 94% (823/875) Receiving objects: 95% (832/875) Receiving objects: 96% (840/875) Receiving objects: 97% (849/875) remote: Total 875 (delta 0), reused 875 (delta 0) Receiving objects: 98% (858/875) Receiving objects: 99% (867/875) Receiving objects: 100% (875/875) Receiving objects: 100% (875/875), 3.80 MiB | 19.26 MiB/s, done.From https://diffinery.com/codician/diffinery * [new ref] 36263e52cb3006fee980a92ad3ee3e6fcae6688d -> origin/diffinery-checkoutNote: switching to '36263e52cb3006fee980a92ad3ee3e6fcae6688d'.You are in 'detached HEAD' state. You can look around, make experimentalchanges and commit them, and you can discard any commits you make in thisstate without impacting any branches by switching back to a branch.If you want to create a new branch to retain commits you create, you maydo so (now or later) by using -c with the switch command. Example: git switch -c <new-branch-name>Or undo this operation with: git switch -Turn off this advice by setting config variable advice.detachedHead to falseHEAD is now at 36263e5 Merge 503bdef8da45623fa39b484f2ad2446747d67634 into db0badff555154599b606f2bbd04b6f811dca3e9HEAD is now at 36263e52cb3006fee980a92ad3ee3e6fcae6688d
Run pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b13s
Download action repository 'pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1'##[group]Run pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1with: dest: ~/setup-pnpm run_install: null cache: false cache_dependency_path: pnpm-lock.yaml package_json_file: package.json standalone: false##[endgroup]##[group]Running self-installer...Progress: resolved 1, reused 0, downloaded 0, added 0Packages: +1+Progress: resolved 1, reused 0, downloaded 1, added 1, donedependencies:+ pnpm 10.28.0 (12.15.0 is available)Done in 1.8s##[endgroup]Installation Completed!
Run actions/setup-node@v411s
##[group]Run actions/setup-node@v4with: node-version: 22 cache: pnpm##[endgroup]Found in cache @ 22.22.0 (pre-installed node satisfies '22')Cache Size: ~216 MB (226934503 B)Cache restored from key: node-cache-Linux-x64-pnpm-42d02c0263a3b5f911ed6ae8e9210922b97166ca02e60b2c70c55dfa1f00371b
Run pnpm install --frozen-lockfile7s
##[group]Run pnpm install --frozen-lockfile##[endgroup]Scope: all 8 workspace projectsLockfile is up to date, resolution step is skippedProgress: resolved 1, reused 0, downloaded 0, added 0Packages: +251++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++Progress: resolved 251, reused 245, downloaded 0, added 28Progress: resolved 251, reused 245, downloaded 0, added 194Progress: resolved 251, reused 245, downloaded 0, added 251, done.../esbuild@0.25.12/node_modules/esbuild postinstall$ node install.js.../esbuild@0.25.11/node_modules/esbuild postinstall$ node install.js.../node_modules/workerd postinstall$ node install.js.../esbuild@0.28.1/node_modules/esbuild postinstall$ node install.js.../node_modules/workerd postinstall$ node install.js.../esbuild@0.25.11/node_modules/esbuild postinstall: Done.../esbuild@0.28.2/node_modules/esbuild postinstall$ node install.js.../node_modules/workerd postinstall: Done.../esbuild@0.28.1/node_modules/esbuild postinstall: Done.../esbuild@0.25.12/node_modules/esbuild postinstall: Done.../node_modules/workerd postinstall: Done.../esbuild@0.28.2/node_modules/esbuild postinstall: DonedevDependencies:+ turbo 2.11.7+ typescript 5.9.3Done in 6.7s using pnpm v10.28.0
Run pnpm -r --if-present build6s
##[group]Run pnpm -r --if-present build##[endgroup]Scope: 7 of 8 workspace projectsapps/cli build$ esbuild src/bin.ts --bundle --platform=node --target=node22 --format=esm --outfile=dist/diffinery.mjs "--banner:js=#!/usr/bin/env nodeimport { createRequire as __diffineryCreateRequire } from 'node:module'; const require = __diffineryCreateRequire(import.meta.url);"apps/diffinery build$ node islands/build.mjs && node scripts/build-docs.mjscontainers/runner build$ esbuild src/main.ts --bundle --platform=node --target=node22 --format=esm --outfile=dist/agent.mjs --external:bufferutil --external:utf-8-validate "--banner:js=import { createRequire as __diffineryCreateRequire } from 'node:module'; const require = __diffineryCreateRequire(import.meta.url);"apps/cli build: dist/diffinery.mjs 468.9kbapps/cli build: ⚡ Done in 146mscontainers/runner build: dist/agent.mjs 684.1kbcontainers/runner build: ⚡ Done in 150msapps/cli build: Donecontainers/runner build: Doneapps/diffinery build: islands: kumo.js 466 KB, kumo.css 149 KB, terminal.js 286 KBapps/diffinery build: docs: 84 pages (+2 generated at runtime), 19 site pages, 11 images, CLI 0.1.0 (250 KiB), editor extension 0.1.1 (20 KiB), JetBrains plugin 0.1.0 (64 KiB), Claude Code plugins diffinery 0.1.3, diffinery-ci 0.2.3apps/diffinery build: Done
Run pnpm --filter @diffinery/app exec playwright install --with-deps chromium
Run as_root() { if [ "$(id -u)" = 0 ]; then "$@"; else sudo "$@"; fi; }
Run the shard's tests19h 54m
##[group]Run # Shards of similar length; a new test file runs in "rest" unless it's added to another.core='/e2e\.test\.mjs$'agents='/(agentic|review|tasks)\.test\.mjs$'# security.test.mjs, security-*.test.mjs (security-txt's too) and status.test.mjs.security='/(security(-[a-z-]+)?|status)\.test\.mjs$'# The core file's real histories and large pushes take minutes each (jquery's alone 2 to 3 on# Diffinery's runners): two shards of their own, so no part of the file runs into node's# per-file timeout, which is the --test-timeout here.histories='^real histories:'large='^(large files|large pushes):'opts=(--test-timeout=600000)case "security" in core) files=$(ls test/e2e/*.test.mjs | grep -E "$core"); opts+=(--test-skip-pattern="$histories" --test-skip-pattern="$large") ;; histories) files=$(ls test/e2e/*.test.mjs | grep -E "$core"); opts=(--test-timeout=900000 --test-name-pattern="$histories") ;; large) files=$(ls test/e2e/*.test.mjs | grep -E "$core"); opts+=(--test-name-pattern="$large") ;; agents) files=$(ls test/e2e/*.test.mjs | grep -E "$agents") ;; security) files=$(ls test/e2e/*.test.mjs | grep -E "$security") ;; *) files=$(ls test/e2e/*.test.mjs | grep -vE "$core|$agents|$security") ;;esacecho "$files"# Two files at a time: each starts its own local server on its own port, database and# directory, so they don't share state, and a file's server mostly keeps one core busy.node --test --test-concurrency=2 "${opts[@]}" $files##[endgroup]test/e2e/security-limits.test.mjstest/e2e/security-txt.test.mjstest/e2e/security.test.mjstest/e2e/status.test.mjsTAP version 13# Subtest: security: environment reviewers hold a deploy job until a listed person approves, and nobody else canok 1 - security: environment reviewers hold a deploy job until a listed person approves, and nobody else can --- duration_ms: 65970.772987 type: 'test' ...# Subtest: security: adding someone by username sends an invitation, and they get access only once they acceptok 2 - security: adding someone by username sends an invitation, and they get access only once they accept --- duration_ms: 3307.150967 type: 'test' ...# Subtest: security: per-account quotas on hosted minutes, hosted jobs at once, sandboxes and repositoriesok 3 - security: per-account quotas on hosted minutes, hosted jobs at once, sandboxes and repositories --- duration_ms: 66103.1341 type: 'test' ...# Subtest: security: a per-account storage quota refuses pushes, Git LFS and release asset uploads past it; reads and deletes keep workingok 4 - security: a per-account storage quota refuses pushes, Git LFS and release asset uploads past it; reads and deletes keep working --- duration_ms: 4947.329669 type: 'test' ...# Subtest: security: kill switches suspend Actions for a repository or an account, and pause hosted compute on the instanceok 5 - security: kill switches suspend Actions for a repository or an account, and pause hosted compute on the instance --- duration_ms: 31753.719221 type: 'test' ...# Subtest: security: Markdown images from other sites load through Diffinery's signed image proxyok 6 - security: Markdown images from other sites load through Diffinery's signed image proxy --- duration_ms: 513.307295 type: 'test' ...# Subtest: security.txt: every RFC 9116 field with SECURITY_CONTACT setok 7 - security.txt: every RFC 9116 field with SECURITY_CONTACT set --- duration_ms: 42361.43487 type: 'test' ...# Subtest: security reports: security.txt names the form, and an anonymous report needs a reply-to addressok 8 - security reports: security.txt names the form, and an anonymous report needs a reply-to address --- duration_ms: 13934.163264 type: 'test' ...# Subtest: security reports: a signed-in report replies to the account's addressok 9 - security reports: a signed-in report replies to the account's address --- duration_ms: 148.477731 type: 'test' ...# Subtest: security reports: only site administrators can see them (404 for anyone else)ok 10 - security reports: only site administrators can see them (404 for anyone else) --- duration_ms: 320.075963 type: 'test' ...# Subtest: security reports: each new report emails the site administrators, and only themok 11 - security reports: each new report emails the site administrators, and only them --- duration_ms: 591.871152 type: 'test' ...# Subtest: security reports: triage and resolve, on the web and through the API, auditedok 12 - security reports: triage and resolve, on the web and through the API, audited --- duration_ms: 266.715787 type: 'test' ...# Subtest: security: search, required checks, environments, reviews, locks, archives, drafts and tree namesok 13 - security: search, required checks, environments, reviews, locks, archives, drafts and tree names --- duration_ms: 27450.410119 type: 'test' ...# Subtest: security: organization admins can't hand out ownershipok 14 - security: organization admins can't hand out ownership --- duration_ms: 244.499906 type: 'test' ...# Subtest: security: anonymous writes, token scopes, agent secrets, merge rules and draftsok 15 - security: anonymous writes, token scopes, agent secrets, merge rules and drafts --- duration_ms: 3345.346216 type: 'test' ...# Subtest: security: push protection covers commits made without gitok 16 - security: push protection covers commits made without git --- duration_ms: 768.143726 type: 'test' ...# Subtest: security: limited tokens, invisible repositories, readers' labels and the audit trailok 17 - security: limited tokens, invisible repositories, readers' labels and the audit trail --- duration_ms: 28858.396751 type: 'test' ...# Subtest: security: organization pictures are the owners' to change, and invitations aren't sent twiceok 18 - security: organization pictures are the owners' to change, and invitations aren't sent twice --- duration_ms: 366.434455 type: 'test' ...# Subtest: security: organization members get the base permission, which only owners changeok 19 - security: organization members get the base permission, which only owners change --- duration_ms: 893.745666 type: 'test' ...# Subtest: security: leaving an organization takes its repository access alongok 20 - security: leaving an organization takes its repository access along --- duration_ms: 824.324913 type: 'test' ...# Subtest: security: organization settings are checked before anything is saved, and agents see the base permissionok 21 - security: organization settings are checked before anything is saved, and agents see the base permission --- duration_ms: 7414.740826 type: 'test' ...# Subtest: security: a transferred repository keeps its data, and its old name redirects only for readersok 22 - security: a transferred repository keeps its data, and its old name redirects only for readers --- duration_ms: 13012.792735 type: 'test' ...# Subtest: security: agents land changes on protected branches only through auto-merge a person allowed, gated by CIok 23 - security: agents land changes on protected branches only through auto-merge a person allowed, gated by CI --- duration_ms: 25975.205066 type: 'test' ...# Subtest: security: an admin can let agents' auto-merges land on green checks without an approval, and nothing moreok 24 - security: an admin can let agents' auto-merges land on green checks without an approval, and nothing more --- duration_ms: 16905.173831 type: 'test' ...