Live test reads npm's version line only; the E2E bwrap step needs no sudo on Diffinery's runners (#156)
The jail step on Cloudflare caught an "npm notice" line instead of the version, so it now runs npm without the update notifier, keeps only a version line and prints npm's errors. Diffinery's runner image has bwrap and no sudo: the E2E step installs bubblewrap only when it's missing, as root where it can. Claude-Session: https://claude.ai/code/session_014VDQqT8oL18uLJ9fpsNxW2 Co-authored-by: Claude <noreply@anthropic.com>
Canberk Demirci authored · GitHub committed signed1 parent 9552cd2commit a6ebb4c9c7b4fdfec2d321600b77b9997e54dd95Browse files
2 files changed+9−4
modified.github/workflows/e2e.yml+6−3View file
| @@ -44,11 +44,14 @@ | ||
| 44 | 44 | - if: matrix.shard == 'rest' |
| 45 | 45 | run: pnpm --filter @diffinery/app exec playwright install --with-deps chromium |
| 46 | 46 | # Terminal tasks run in a bubblewrap jail (containers/runner/src/jail.ts); Ubuntu's AppArmor otherwise keeps |
| 47 | - # it from creating user namespaces. | |
| 47 | + # it from creating user namespaces. Diffinery's own runner image already has bwrap and no sudo, running as root. | |
| 48 | 48 | - if: matrix.shard == 'rest' |
| 49 | 49 | run: | |
| 50 | - sudo apt-get install -y --no-install-recommends bubblewrap | |
| 51 | - sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0 || true | |
| 50 | + as_root() { if [ "$(id -u)" = 0 ]; then "$@"; else sudo "$@"; fi; } | |
| 51 | + if ! command -v bwrap >/dev/null; then | |
| 52 | + as_root apt-get install -y --no-install-recommends bubblewrap || { as_root apt-get update -qq && as_root apt-get install -y --no-install-recommends bubblewrap; } | |
| 53 | + fi | |
| 54 | + as_root sysctl -w kernel.apparmor_restrict_unprivileged_userns=0 2>/dev/null || true | |
| 52 | 55 | bwrap --unshare-all --ro-bind / / --dev /dev --proc /proc -- true |
| 53 | 56 | - name: Run the shard's tests |
| 54 | 57 | working-directory: apps/diffinery |
modified.github/workflows/live-test.yml+3−1View file
| @@ -540,7 +540,9 @@ | ||
| 540 | 540 | echo "other=$(curl -sS -m 20 -o /dev/null -w "%{http_connect}" https://example.com 2>/dev/null || true)" |
| 541 | 541 | echo "checkout=$(ls -A /workspace/repo | paste -sd,)" |
| 542 | 542 | echo "credential=$(cat /workspace/repo/.git/config 2>/dev/null || echo hidden)" |
| 543 | - echo "npm=$(npm view left-pad version 2>&1 | tail -1)"' | |
| 543 | + v=$(npm view left-pad version --no-update-notifier --loglevel=error 2>/tmp/npm.err) | |
| 544 | + echo "npm=$(printf "%s\n" "$v" | grep -E "^[0-9]+\.[0-9]+\.[0-9]+$" | tail -1)" | |
| 545 | + echo "npmerr=$(tail -3 /tmp/npm.err | paste -sd" " -)"' | |
| 544 | 546 | out=$(run "mkdir -p ../jail-check ../jail-check.out && \"\$DIFFINERY_JAIL\" agent --dir ../jail-check --out ../jail-check.out -- sh -c $(printf '%q' "$inside")") |
| 545 | 547 | echo "$out" | jq -r '"exit \(.exitCode)", .stdout, .stderr' |
| 546 | 548 | o=$(jq -r .stdout <<<"$out") |