Ci/sudo install tests #313
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: ci | |
| on: | |
| push: | |
| branches: | |
| - main | |
| pull_request: | |
| concurrency: | |
| group: ${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| lint: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: denolib/setup-deno@v2 | |
| with: | |
| deno-version: v2.x | |
| - run: deno fmt --check . | |
| - run: deno lint . | |
| - run: deno check ./pkgm.ts | |
| #TODO test on linux! we are currently broken due to rpath issues | |
| # https://github.com/pkgxdev/pkgm/pull/30#issuecomment-2678957666 | |
| test: | |
| continue-on-error: true | |
| strategy: | |
| matrix: | |
| os: | |
| - macos-latest | |
| - ubuntu-latest | |
| runs-on: ${{ matrix.os }} | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: pkgxdev/setup@v4 | |
| - run: ./pkgm.ts i git | |
| - run: ~/.local/bin/git --version | |
| - run: "! test -f /usr/local/bin/git" | |
| - run: ./pkgm.ts ls | grep .local/pkgs/git-scm.org | |
| - run: ./pkgm.ts rm git | |
| - run: test ! -f ~/.local/bin/git | |
| - run: ./pkgm.ts i pkgx.sh/brewkit | |
| - run: ~/.local/bin/bk --help | |
| # check repeats work | |
| - run: rm ~/.local/bin/bk | |
| - run: test ! -f /usr/local/bin/bk | |
| - run: ./pkgm.ts i pkgx.sh/brewkit | |
| - run: ~/.local/bin/bk --help | |
| - run: ./pkgm.ts i gum | |
| - run: ~/.local/bin/gum --version | |
| # test a thing with deps | |
| # https://github.com/pkgxdev/pkgm/issues/24 | |
| - run: ./pkgm.ts i curl | |
| - run: ~/.local/bin/curl -L pkgx.sh | |
| - run: ./pkgm.ts shim semverator | |
| - run: ~/.local/bin/semverator validate 1.0.0 | |
| # tests shims do not shim deps | |
| - run: ./pkgm.ts shim node@20 | |
| - run: test ! -d ~/.local/bin/openssl | |
| - run: if [[ $(~/.local/bin/node --version) != v20* ]]; then false; fi | |
| - run: ./pkgm.ts i hyperfine@1.18 | |
| - run: ./pkgm.ts outdated | grep hyperfine | |
| - run: if pkgx semverator satisfies '>=1.19' "$(hyperfine --version | cut -f 2 -d ' ')"; then false; fi | |
| - run: ./pkgm.ts update | |
| - run: pkgx semverator satisfies '>=1.19' "$(hyperfine --version | cut -f 2 -d ' ')" | |
| # TODO pending: https://github.com/pkgxdev/pantry/issues/8487 | |
| # - run: ./pkgm.ts i xpra.org # https://github.com/pkgxdev/pkgm/issues/13 | |
| # - run: ls -la /usr/local/pkgs/xpra.org/v6.2.3/venv/bin | |
| # - run: xpra --version | |
| # verifies that libpkgx is creating the pantry at the right place | |
| # Refs: https://github.com/pkgxdev/pkgm/issues/59 | |
| - run: | | |
| ./pkgm.ts i semverator | |
| if test -d /tmp/foo/pkgx; then | |
| test $(uname) = Linux | |
| else | |
| test $(uname) = Darwin | |
| fi | |
| env: | |
| XDG_DATA_HOME: /tmp/foo | |
| - run: | | |
| set -x | |
| sudo ./pkgm.ts i node@22 dev | |
| [[ $(node --version) = v22* ]] || exit 2 | |
| mkdir foo | |
| cd foo | |
| echo "dependencies: node@20" > pkgx.yaml | |
| mkdir -p /tmp/bar/pkgx/dev$PWD/ | |
| touch /tmp/bar/pkgx/dev$PWD/dev.pkgx.activated # `dev .` doesn’t work in CI (fix in dev^2) | |
| [[ $(node --version) = v20* ]] || exit 3 | |
| env: | |
| XDG_DATA_HOME: /tmp/bar | |
| # https://github.com/pkgxdev/pkgm/issues/62 | |
| - run: | | |
| ./pkgm.ts i spotify_player | |
| spotify_player --version | |
| # Validates `sudo pkgm install` behaviour fixed in 2b33f20: | |
| # - privilege drop so pkgx cache stays owned by $SUDO_USER, not root | |
| # - HOME override so the cache lands under the invoking user's tree | |
| # - fallback to running pkgx as root when it lives under /root/.pkgx | |
| # and is therefore unreachable to $SUDO_USER (pkgxdev/pkgm#68) | |
| # Linux-only: the /root/.pkgx scenario doesn't arise on macOS in practice. | |
| sudo-install: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: pkgxdev/setup@v4 | |
| - name: sudo install drops privileges and overrides HOME | |
| run: | | |
| set -eux | |
| # marker to scope checks to entries created by this install | |
| touch /tmp/pkgm-sudo-marker | |
| sudo ./pkgm.ts i hyperfine | |
| test -x /usr/local/bin/hyperfine | |
| # HOME override + privilege drop are validated via the pkg cache | |
| # under $HOME/.pkgx. We deliberately do NOT assert that | |
| # /root/.pkgx is empty: the shebang's `pkgx --quiet deno^2.1 run …` | |
| # runs as root before any pkgm.ts code executes, and that outer | |
| # pkgx caches under $HOME/.pkgx which resolves to /root/.pkgx | |
| # under sudo. That cache is unavoidable and unrelated to whether | |
| # pkgm's *inner* pkgx call dropped privileges. | |
| # | |
| # We check for newly created entries (directories specifically), | |
| # not files: tar -x preserves the archive's original mtimes on | |
| # extracted files, so file mtimes are typically *older* than the | |
| # marker. Directories are created fresh by `mkdir` during | |
| # extraction and reliably have a current mtime. | |
| new_dirs=$(sudo find "$HOME/.pkgx" -newer /tmp/pkgm-sudo-marker -type d -print 2>/dev/null | head -1 || true) | |
| if [ -z "$new_dirs" ]; then | |
| echo "::error::no new directories under \$HOME/.pkgx — inner pkgx did not cache to invoking user's tree" | |
| exit 1 | |
| fi | |
| owned_by_root=$(sudo find "$HOME/.pkgx" -newer /tmp/pkgm-sudo-marker -user root -print 2>/dev/null || true) | |
| if [ -n "$owned_by_root" ]; then | |
| echo "::error::pkgx cache entries created as root under \$HOME/.pkgx — privilege drop failed:" | |
| echo "$owned_by_root" | |
| exit 1 | |
| fi | |
| - name: sudo install falls back when pkgx is unreachable as $SUDO_USER | |
| # Must be last — this step strips pkgx from every location the | |
| # runner user can reach, leaving only /root/.pkgx, which the | |
| # subsequent shebang resolution still needs to walk through sudo. | |
| run: | | |
| set -eux | |
| # Stage pkgx exclusively under /root so that reachable_as() returns | |
| # false for the runner user and no alternative is found. | |
| pkgx_src=$(command -v pkgx) | |
| sudo mkdir -p /root/.pkgx/bin | |
| sudo cp "$pkgx_src" /root/.pkgx/bin/pkgx | |
| # Wipe every alternative the resolver looks for: | |
| # ~/.pkgx/pkgx.sh/v*/bin/pkgx, ~/.local/bin/pkgx, /usr/local/bin/pkgx | |
| rm -rf "$HOME/.pkgx" | |
| sudo rm -f /usr/local/bin/pkgx "$HOME/.local/bin/pkgx" | |
| # Invoke pkgm.ts with the /root pkgx on PATH. `sudo env PATH=...` | |
| # is the canonical way around the default secure_path policy in | |
| # Ubuntu's sudoers. | |
| set +e | |
| out=$(sudo env PATH="/root/.pkgx/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin" ./pkgm.ts i gum 2>&1) | |
| rc=$? | |
| set -e | |
| echo "$out" | |
| # Regression check for pkgxdev/pkgm#68: the install succeeds without | |
| # crashing when only the sudo-only pkgx remains reachable. | |
| test $rc -eq 0 | |
| test -x /usr/local/bin/gum |