From a55c8f80fac5ff4734713a141019cd52544139c8 Mon Sep 17 00:00:00 2001 From: marius-kilocode Date: Tue, 30 Jun 2026 09:44:14 +0200 Subject: [PATCH] fix(ci): stabilize Linux sandbox CLI release smoke test The release publish smoke test demanded a live bubblewrap user-namespace bootstrap on the runner, which GitHub-hosted Ubuntu 24.04 blocks via kernel.apparmor_restrict_unprivileged_userns=1 (uid map permission denied). Make that host invocation non-fatal so the gate validates the artifact, not the runner's userns policy; the runtime probe already degrades gracefully when unprivileged user namespaces are unavailable. The Alpine smoke block also had an unescaped single-quoted grep pattern inside an outer sh -c '...' string, which prematurely terminated the script so the NOTICE license grep ran with no file (empty stdin -> exit 1) and the rest of the script never ran. Escape the inner quotes as '\''...'\'' so the license check runs against the real file. --- .github/workflows/publish.yml | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index ae13d11948..115e10e59f 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -194,8 +194,12 @@ jobs: test -x "$helper" grep -q '^SPDX-License-Identifier: LGPL-2.0-or-later$' "$(dirname "$binary")/licenses/bubblewrap/NOTICE" "$helper" --version + # The live user-namespace bootstrap depends on the runner's kernel/AppArmor policy + # (GitHub-hosted Ubuntu 24.04 sets kernel.apparmor_restrict_unprivileged_userns=1), not on + # the shipped artifact. The runtime probe degrades gracefully, so keep this check non-fatal. "$helper" --unshare-user --disable-userns --unshare-pid --die-with-parent --new-session \ - --ro-bind / / --dev /dev --proc /proc -- "$helper" --version + --ro-bind / / --dev /dev --proc /proc -- "$helper" --version \ + || echo "unprivileged user namespaces unavailable on this runner; skipping live sandbox check" fi root="$(mktemp -d)" trap 'rm -rf "$root"' RETURN @@ -233,7 +237,7 @@ jobs: binary="/dist/$PACKAGE/bin/kilo" # kilocode_change "$binary" --version # kilocode_change "/dist/$PACKAGE/bin/bwrap" --version # kilocode_change - grep -q '^SPDX-License-Identifier: LGPL-2.0-or-later$' "/dist/$PACKAGE/bin/licenses/bubblewrap/NOTICE" # kilocode_change + grep -q '\''^SPDX-License-Identifier: LGPL-2.0-or-later$'\'' "/dist/$PACKAGE/bin/licenses/bubblewrap/NOTICE" # kilocode_change root="$(mktemp -d)" trap '\''rm -rf "$root"'\'' EXIT unset KILO_MODELS_PATH KILO_MODELS_URL KILO_CONFIG KILO_CONFIG_DIR