heavy-duty/rig
7
0
Fork 1
Code Issues 10 Pull requests Projects Releases 3 Packages Wiki Activity Actions

test(cli): the pin-validation checks read the gate below, whoever runs them
Some checks failed
ci / check (pull_request) Successful in 1m7s
Details
ci / install (pull_request) Successful in 3s
Details
ci / db-integration (pull_request) Successful in 3s
Details
labels / labels (pull_request) Failing after 7s
Details

Browse source 
Two checks proved a good --version got through validation by asserting the
NEXT gate down, 'must run as root'. That gate only exists for a non-root
caller. The Forgejo runner runs job containers as uid 0 — GitHub's runner is
the unprivileged 'runner' user — so on this forge both checks failed, and
'ci / check' stayed red after the shellcheck cause was fixed. #136's class,
in a place its sweep did not reach.

Both gates are equally good evidence that validation is behind us, so accept
either, and keep requiring exit 1 so a validation refusal (exit 2) still
fails the check.

Refs #144
This commit is contained in:
cluade-reviewer-andresmgsl 2026-08-01 21:24:52 +00:00
parent cc5f478e77
commit 0daa2d0095
1 changed files with 19 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

25
test/cli.sh
View file

@ -3349,12 +3349,25 @@ check "forgejo-runner: --version refuses a path, not a release number" 2 "releas
"$FR" --instance https://f.example.com --version ../../etc/passwd
check "forgejo-runner: --version refuses a non-numeric pin" 2 "release number like" \
"$FR" --instance https://f.example.com --version latest
# Reaching the root check is the proof a good pin got THROUGH validation: this
# runs as a normal user in CI, so "must run as root" is the next gate down.
check "forgejo-runner: a plain release number passes validation" 1 "must run as root" \
"$FR" --instance https://f.example.com --version 12.13.2
check "forgejo-runner: a leading v is stripped before that check" 1 "must run as root" \
"$FR" --instance https://f.example.com --version v12.13.2
# Reaching the gate BELOW validation is the proof a good pin got THROUGH it.
# Which gate that is depends on who runs the suite, and both readings are
# equally good evidence: a normal user hits "must run as root", while root
# itself gets further, to the token prompt. Asserting only the first made these
# two checks depend on the account the suite happened to run under — #136's
# class again, surfaced by the Forgejo runner, which runs job containers as
# uid 0 where GitHub's runner is the unprivileged `runner` user. Either way the
# exit is 1 and validation is behind us, which is the whole claim (#144).
past_version_validation() {
local out rc
out="$("$FR" --instance https://f.example.com --version "$1" 2>&1)"; rc=$?
[ "$rc" -eq 1 ] || { printf 'exit %s, wanted 1\n' "$rc"; return 1; }
printf '%s' "$out" | grep -qE 'must run as root|FORGEJO_RUNNER_TOKEN is unset' \
|| { printf 'neither gate below validation was reached:\n%s\n' "$out"; return 1; }
}
check "forgejo-runner: a plain release number passes validation" 0 "" \
past_version_validation 12.13.2
check "forgejo-runner: a leading v is stripped before that check" 0 "" \
past_version_validation v12.13.2
# A schemeless host and a repo URL are the two ways an operator mis-states the
# instance, and only one of them would fail loudly on its own — a repo URL
# registers somewhere subtly wrong instead. Both refuse by name.