From 2772ed0434989378e4c199667d87d3e9bf53ff2b Mon Sep 17 00:00:00 2001
From: marius-kilocode <marius@kilocode.ai>
Date: Tue, 23 Jun 2026 18:02:31 +0200
Subject: [PATCH] chore(ci): annotate Linux sandbox workflows

---
 .github/workflows/publish.yml | 6 ++++--
 .github/workflows/test.yml    | 4 ++++
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index b9a76b6b74..4ecf968219 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -84,11 +84,13 @@ jobs:
 
       - uses: ./.github/actions/setup-bun
 
+      # kilocode_change start
       - name: Setup Zig for Linux sandbox helpers
         uses: mlugg/setup-zig@d1434d08867e3ee9daa34448df10607b98908d29 # v2.2.1
         with:
           version: 0.14.0
           use-cache: false
+      # kilocode_change end
 
       - name: Build
         id: build
@@ -225,9 +227,9 @@ jobs:
               # as optional packages and must be installed for any Bun-compiled musl binary to run.
               apk add --no-cache libstdc++ libgcc
               # kilocode_change end
-              binary="/dist/$PACKAGE/bin/kilo"
+              binary="/dist/$PACKAGE/bin/kilo" # kilocode_change
               "$binary" --version
-              "/dist/$PACKAGE/bin/bwrap" --version
+              "/dist/$PACKAGE/bin/bwrap" --version # kilocode_change
               root="$(mktemp -d)"
               trap '\''rm -rf "$root"'\'' EXIT
               unset KILO_MODELS_PATH KILO_MODELS_URL KILO_CONFIG KILO_CONFIG_DIR
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index a37de39bfa..134002c3c6 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -63,6 +63,7 @@ jobs:
       - name: Setup Bun
         uses: ./.github/actions/setup-bun
 
+      # kilocode_change start
       - name: Setup Zig for Linux sandbox helper
         if: runner.os == 'Linux'
         uses: mlugg/setup-zig@d1434d08867e3ee9daa34448df10607b98908d29 # v2.2.1
@@ -75,6 +76,7 @@ jobs:
         run: |
           bun packages/opencode/script/kilocode/bubblewrap.ts --arch x64 --output "$RUNNER_TEMP/bwrap"
           echo "KILO_BWRAP_PATH=$RUNNER_TEMP/bwrap" >> "$GITHUB_ENV"
+      # kilocode_change end
 
       - name: Configure git identity
         run: |
@@ -96,11 +98,13 @@ jobs:
           KILO_EXPERIMENTAL_DISABLE_FILEWATCHER: ${{ runner.os == 'Windows' && 'true' || 'false' }}
           KILO_TEST_PROFILE: ${{ runner.os == 'macOS' && github.event_name == 'pull_request' && 'darwin' || '' }} # kilocode_change
 
+      # kilocode_change start
       - name: Test nested mount rejection
         if: runner.os == 'Linux'
         run: |
           sudo env PATH="$PATH" KILO_BWRAP_PATH="$KILO_BWRAP_PATH" KILO_TEST_PRIVILEGED_MOUNTS=1 \
             "$(command -v bun)" test packages/core/test/kilocode/linux-sandbox.test.ts -t "nested mount"
+      # kilocode_change end
 
       - name: Run HttpApi exerciser gates
         if: runner.os == 'Linux' # kilocode_change