From dc55a7d08d8f2afa3d57c8a5d41b7c408e689d14 Mon Sep 17 00:00:00 2001 From: Peter Steinberger Date: Fri, 14 Aug 2026 14:45:39 -0700 Subject: [PATCH] ci: expand Linux installer verification (#123849) --- .github/workflows/website-installer-sync.yml | 153 +++++++++++++++++- .../website-installer-sync-workflow.test.ts | 32 +++- 2 files changed, 181 insertions(+), 4 deletions(-) diff --git a/.github/workflows/website-installer-sync.yml b/.github/workflows/website-installer-sync.yml index 5dc7dc10bf03..2c47e02ed9b5 100644 --- a/.github/workflows/website-installer-sync.yml +++ b/.github/workflows/website-installer-sync.yml @@ -87,6 +87,150 @@ jobs: node:24-bookworm-slim \ bash -lc 'apt-get update -y && apt-get install -y curl && bash /tmp/install-cli.sh --prefix /tmp/openclaw --no-onboard --version latest && /tmp/openclaw/bin/openclaw --version' + linux-build-tools-failure: + runs-on: ubuntu-24.04 + steps: + - name: Checkout + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - name: install.sh reports build-tool failures honestly + run: | + timeout --kill-after=10s 5m docker run --rm -i \ + -v "$PWD/scripts/install.sh:/tmp/install.sh:ro" \ + debian:bookworm \ + bash -s <<'CONTAINER' + set -euo pipefail + export PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin" + + cat > /usr/local/sbin/apt-get <<'STUB' + #!/bin/bash + for arg in "$@"; do + if [[ "$arg" == "build-essential" ]]; then + : > /tmp/build-tools-stub-triggered + echo "E: simulated package manager failure" >&2 + exit 100 + fi + done + for arg in "$@"; do + if [[ "$arg" == "update" ]]; then + exit 0 + fi + done + echo "unexpected apt-get call: $*" >&2 + exit 99 + STUB + + cat > /usr/local/bin/curl <<'STUB' + #!/bin/sh + echo "network blocked by failure-propagation lane" >&2 + exit 97 + STUB + chmod +x /usr/local/sbin/apt-get /usr/local/bin/curl + + installer_status=0 + bash /tmp/install.sh --no-onboard --no-prompt /tmp/out.log 2>&1 || installer_status=$? + cat /tmp/out.log + + if [[ ! -f /tmp/build-tools-stub-triggered ]]; then + echo "stub did not trigger" >&2 + exit 2 + fi + if ! grep -aFq "Installing build tools failed" /tmp/out.log; then + echo "installer did not report the simulated build-tools failure" >&2 + exit 2 + fi + if grep -aFq "Build tools installed" /tmp/out.log; then + echo "REGRESSION: installer claimed success after failure" >&2 + exit 1 + fi + if (( installer_status == 0 )); then + echo "installer unexpectedly completed despite blocked package and network access" >&2 + exit 3 + fi + echo "ok: failure reported honestly" + CONTAINER + + linux-non-root: + runs-on: ubuntu-24.04 + steps: + - name: Checkout + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - name: install.sh as a non-root user + run: | + timeout --kill-after=30s 20m docker run --rm -i \ + -v "$PWD/scripts/install.sh:/tmp/install.sh:ro" \ + node:24-bookworm-slim \ + bash -s <<'CONTAINER' + set -euo pipefail + apt-get update -qq + apt-get install -y -qq sudo + useradd --create-home --shell /bin/bash installer + printf '%s\n' 'installer ALL=(ALL) NOPASSWD:ALL' > /etc/sudoers.d/installer + chmod 0440 /etc/sudoers.d/installer + + sudo -u installer -H bash <<'USER' + set -euo pipefail + test "$(id -u)" -ne 0 + sudo -n true + initial_prefix="$(npm config get prefix)" + if [[ -w "$initial_prefix" || -w "$initial_prefix/lib" ]]; then + echo "initial npm prefix is writable; relocation path would not run" >&2 + exit 1 + fi + bash /tmp/install.sh --install-method npm --no-onboard --no-prompt --version latest + test "$(npm config get prefix)" = "$HOME/.npm-global" + "$HOME/.npm-global/bin/openclaw" --version + grep -Fxq 'export PATH="$HOME/.npm-global/bin:$PATH"' "$HOME/.bashrc" + echo "ok: non-root prefix relocation and bash PATH persistence verified" + USER + CONTAINER + + fedora-installer: + name: Fedora installer (${{ matrix.user }}) + strategy: + fail-fast: false + matrix: + user: [root, non-root] + runs-on: ubuntu-24.04 + steps: + - name: Checkout + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - name: install.sh on Fedora + env: + INSTALL_USER: ${{ matrix.user }} + run: | + if [[ "$INSTALL_USER" == "root" ]]; then + timeout --kill-after=30s 20m docker run --rm -i \ + -v "$PWD/scripts/install.sh:/tmp/install.sh:ro" \ + fedora:44 \ + bash -s <<'CONTAINER' + set -euo pipefail + bash /tmp/install.sh --install-method npm --no-onboard --no-prompt --version latest + openclaw --version + CONTAINER + else + timeout --kill-after=30s 20m docker run --rm -i \ + -v "$PWD/scripts/install.sh:/tmp/install.sh:ro" \ + fedora:44 \ + bash -s <<'CONTAINER' + set -euo pipefail + dnf install -y -q sudo shadow-utils + useradd --create-home --shell /bin/bash installer + printf '%s\n' 'installer ALL=(ALL) NOPASSWD: ALL' > /etc/sudoers.d/installer + chmod 0440 /etc/sudoers.d/installer + + sudo -u installer -H bash <<'USER' + set -euo pipefail + test "$(id -u)" -ne 0 + sudo -n true + bash /tmp/install.sh --install-method npm --no-onboard --no-prompt --version latest + test "$(npm config get prefix)" = "$HOME/.npm-global" + "$HOME/.npm-global/bin/openclaw" --version + grep -Fxq 'export PATH="$HOME/.npm-global/bin:$PATH"' "$HOME/.bashrc" + echo "ok: Fedora non-root install and PATH persistence verified" + USER + CONTAINER + fi + macos-installer: runs-on: macos-15 steps: @@ -123,7 +267,14 @@ jobs: run: .\scripts\install.ps1 -DryRun -NoOnboard -InstallMethod npm sync-website: - needs: [static, linux-docker, macos-installer, windows-installer] + needs: + - static + - linux-docker + - linux-build-tools-failure + - linux-non-root + - fedora-installer + - macos-installer + - windows-installer if: > (github.event_name == 'push' && github.ref == 'refs/heads/main') || (github.event_name == 'workflow_dispatch' && inputs.sync_website) diff --git a/test/scripts/website-installer-sync-workflow.test.ts b/test/scripts/website-installer-sync-workflow.test.ts index fe821840d3d1..063e94794067 100644 --- a/test/scripts/website-installer-sync-workflow.test.ts +++ b/test/scripts/website-installer-sync-workflow.test.ts @@ -16,9 +16,22 @@ describe("website installer sync workflow", () => { } }); - it("verifies installers on Linux Docker plus native macOS and Windows runners", () => { + it("verifies installers across Linux privilege and package-manager paths", () => { expect(workflow).toContain("linux-docker:"); - expect(workflow.match(/timeout --kill-after=30s 20m docker run --rm/g)?.length).toBe(2); + expect(workflow.match(/timeout --kill-after=30s 20m docker run --rm/g)?.length).toBe(5); + expect(workflow).toContain("linux-build-tools-failure:"); + expect(workflow).toContain("/tmp/build-tools-stub-triggered"); + expect(workflow).toContain('grep -aFq "Installing build tools failed"'); + expect(workflow).toContain('grep -aFq "Build tools installed"'); + expect(workflow).toContain("linux-non-root:"); + expect(workflow).toContain("sudo -u installer -H bash"); + expect(workflow).toContain('test "$(npm config get prefix)" = "$HOME/.npm-global"'); + expect(workflow).toContain( + `grep -Fxq 'export PATH="$HOME/.npm-global/bin:$PATH"' "$HOME/.bashrc"`, + ); + expect(workflow).toContain("fedora-installer:"); + expect(workflow).toContain("user: [root, non-root]"); + expect(workflow.match(/fedora:44/g)?.length).toBe(2); expect(workflow).not.toContain("timeout 20m docker run --rm"); expect(workflow).not.toMatch(/(^|\n)\s+docker run --rm/u); expect(workflow).toContain("bash /tmp/install.sh --version latest && openclaw --version"); @@ -39,7 +52,20 @@ describe("website installer sync workflow", () => { }); it("syncs verified scripts to openclaw.ai only after all installer checks pass", () => { - expect(workflow).toContain("needs: [static, linux-docker, macos-installer, windows-installer]"); + const syncNeeds = workflow.match(/ sync-website:\n needs:\n((?: - [^\n]+\n)+)/u); + expect(syncNeeds?.[1]).toBe( + [ + "static", + "linux-docker", + "linux-build-tools-failure", + "linux-non-root", + "fedora-installer", + "macos-installer", + "windows-installer", + ] + .map((job) => ` - ${job}\n`) + .join(""), + ); expect(workflow).toContain("repository: openclaw/openclaw.ai"); expect(workflow).toContain("OPENCLAW_GH_TOKEN: ${{ secrets.OPENCLAW_GH_TOKEN }}"); expect(workflow).toContain("OPENCLAW_GH_TOKEN is not configured");