From 23965bebcaf785d8b3630275220279ed5982c6c7 Mon Sep 17 00:00:00 2001
From: grok-reviewer-andresmgsl <andres+3@heavyduty.builders>
Date: Sat, 1 Aug 2026 21:18:33 +0000
Subject: [PATCH] test: forgejo-runner version pins work when CI runs as root
 (#144)

act-22.04 jobs are uid 0, so "must run as root" is never the next gate after
--version validation. Accept the unattended-token refuse when already root;
keep the non-root arm for GitHub-hosted runners.

Refs #144
---
 test/cli.sh | 22 ++++++++++++++++------
 1 file changed, 16 insertions(+), 6 deletions(-)

diff --git a/test/cli.sh b/test/cli.sh
index 52fca88..c43ab21 100644
--- a/test/cli.sh
+++ b/test/cli.sh
@@ -3349,12 +3349,22 @@ check "forgejo-runner: --version refuses a path, not a release number" 2 "releas
   "$FR" --instance https://f.example.com --version ../../etc/passwd
 check "forgejo-runner: --version refuses a non-numeric pin" 2 "release number like" \
   "$FR" --instance https://f.example.com --version latest
-# Reaching the root check is the proof a good pin got THROUGH validation: this
-# runs as a normal user in CI, so "must run as root" is the next gate down.
-check "forgejo-runner: a plain release number passes validation" 1 "must run as root" \
-  "$FR" --instance https://f.example.com --version 12.13.2
-check "forgejo-runner: a leading v is stripped before that check" 1 "must run as root" \
-  "$FR" --instance https://f.example.com --version v12.13.2
+# Reaching a gate AFTER --version parsing is the proof a good pin got THROUGH
+# validation. Which gate depends on the uid: non-root hits "must run as root";
+# act/Forgejo jobs run as uid 0 (no `runner` account — #144), so they sail past
+# the root check and hit the unattended-token refuse instead. Both prove the
+# same thing. GitHub-hosted ubuntu-latest is non-root and takes the first arm.
+if [ "$(id -u)" -ne 0 ]; then
+  check "forgejo-runner: a plain release number passes validation" 1 "must run as root" \
+    "$FR" --instance https://f.example.com --version 12.13.2
+  check "forgejo-runner: a leading v is stripped before that check" 1 "must run as root" \
+    "$FR" --instance https://f.example.com --version v12.13.2
+else
+  check "forgejo-runner: a plain release number passes validation" 1 "FORGEJO_RUNNER_TOKEN is unset" \
+    env -u FORGEJO_RUNNER_TOKEN "$FR" --instance https://f.example.com --version 12.13.2
+  check "forgejo-runner: a leading v is stripped before that check" 1 "FORGEJO_RUNNER_TOKEN is unset" \
+    env -u FORGEJO_RUNNER_TOKEN "$FR" --instance https://f.example.com --version v12.13.2
+fi
 # A schemeless host and a repo URL are the two ways an operator mis-states the
 # instance, and only one of them would fail loudly on its own — a repo URL
 # registers somewhere subtly wrong instead. Both refuse by name.