From da84523a6dfcdcfe66aeecee050632e55eadefd3 Mon Sep 17 00:00:00 2001 From: Benjamin Diedrichsen Date: Thu, 30 Jul 2026 20:32:36 +0200 Subject: [PATCH] [fix] keyman: a permission-based test the CI runner is root for MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The snapshot run for 0.7.0 failed on this one test and published nothing. `scanPrivateKeys` classifies a file it cannot open as not-a-key, and the test made the file unopenable with `chmod 0o000` — which stops nobody with uid 0, and Gitea's act_runner is a container running as root. So the file was read, recognised as a private key not named id_*, and reported as skipped. A dangling symlink instead: ENOENT is not a permission anyone can override, and it is a realistic ~/.ssh inhabitant. Verified by running the gate in a node:22 container as root, where the whole workspace is now green. Co-Authored-By: Claude Opus 5 (1M context) --- packages/keyman/tests/keys.test.ts | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/packages/keyman/tests/keys.test.ts b/packages/keyman/tests/keys.test.ts index 5e4abb6..4c05d1e 100644 --- a/packages/keyman/tests/keys.test.ts +++ b/packages/keyman/tests/keys.test.ts @@ -73,14 +73,14 @@ describe('scanPrivateKeys', () => { expect(scanPrivateKeys(dir)).toEqual({ keys: [], skipped: [] }); }); - it('ignores a file it cannot read', () => { - write('secret', OPENSSH); - fs.chmodSync(path.join(dir, 'secret'), 0o000); + it('ignores a path it cannot read', () => { + // A dangling symlink, not a 0o000 file: root reads a 0o000 file happily, so + // the mode-based version of this passed here and failed on the CI runner, + // which is a container running as root. ENOENT nobody can override. + fs.symlinkSync(path.join(dir, 'gone'), path.join(dir, 'secret')); // Reported as not-a-key rather than crashing the menu it was building. expect(scanPrivateKeys(dir).skipped).toEqual([]); - - fs.chmodSync(path.join(dir, 'secret'), 0o600); }); it('does not read past the header', () => {