From 27d603f7261fd879fa2203d13d52f0694ee55b6f Mon Sep 17 00:00:00 2001 From: Keith Jackson Date: Sun, 8 Nov 2026 00:20:38 -0600 Subject: [PATCH] =?UTF-8?q?fix(ci):=20umask=200022=20in=20the=20git=20chec?= =?UTF-8?q?kout=20step=20=E2=80=94=20act's=200000=20made=20Ansible=20ignor?= =?UTF-8?q?e=20ansible.cfg?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Run 500 (this PR's first CI run) failed L0 prod-baremetal-not-dev-surface: act runs steps with umask 0000, the checkout was world-writable, and Ansible (now present, via the toolbox) refuses a world-writable directory as an ansible.cfg source. Reproduced and fixed locally in the pinned image. Co-Authored-By: Claude Opus 5.5 --- .gitea/workflows/gate.yml | 7 +++++++ decisions/2026-11-08-gate-toolbox-container.md | 6 ++++++ 2 files changed, 13 insertions(+) diff --git a/.gitea/workflows/gate.yml b/.gitea/workflows/gate.yml index 7e0d617..74d7af6 100644 --- a/.gitea/workflows/gate.yml +++ b/.gitea/workflows/gate.yml @@ -130,6 +130,13 @@ jobs: REF: ${{ github.ref }} run: | set -euo pipefail + # act runs steps with umask 0000, so without this every checked-out directory is + # world-writable — and Ansible then IGNORES infra/ansible/ansible.cfg as a source + # ("Ansible is being run in a world writable directory"), which made the L0 check + # prod-baremetal-not-dev-surface fail on this PR's first CI run (run 500). The + # toolbox has Ansible, so that check now drives it for real. 0022 = what a + # workstation clone gets (reproduced locally: 0000 fails the check, 0022 passes). + umask 0022 git config --global --add safe.directory "$PWD" git init -q . git remote add origin "${SERVER_URL}/${REPOSITORY}" diff --git a/decisions/2026-11-08-gate-toolbox-container.md b/decisions/2026-11-08-gate-toolbox-container.md index b6e0beb..a545e8a 100644 --- a/decisions/2026-11-08-gate-toolbox-container.md +++ b/decisions/2026-11-08-gate-toolbox-container.md @@ -24,6 +24,12 @@ is unchanged): every branch to `refs/remotes/origin/*`, tags, plus the event SHA; detached for a PR, `-B ` for a push; asserts `HEAD == github.sha`. The job token goes to that one fetch via `GIT_CONFIG_*` env and is **not** persisted in `.git/config` (nothing later needs network git). + It sets **`umask 0022`** first: the PR's first CI run (run 500) failed L0 + `prod-baremetal-not-dev-surface` because act runs steps with umask 0000, every checked-out + directory was world-writable, and Ansible (present in the toolbox, absent from the catthehacker + image) then ignored `infra/ansible/ansible.cfg`. Reproduced locally in the pinned image: clone + under umask 0000 → that check fails with the same message; under 0022 → `check OK`. Side + effect worth knowing: the Ansible-driven parts of that check now actually execute in CI. - **"Install pinned CI toolchain" step removed**, replaced by **"Toolchain is the one ci/versions.env pins"**: every `*_VERSION` in `ci/versions.env` must equal the image's `/etc/dev-toolchain-versions`, else `::error::DRIFT` and the job fails. Without this, dropping