ci: expand Linux installer verification (#123849)

.github/workflows/website-installer-sync.yml

@@ -87,6 +87,150 @@ jobs:
             node:24-bookworm-slim \
             bash -lc 'apt-get update -y && apt-get install -y curl && bash /tmp/install-cli.sh --prefix /tmp/openclaw --no-onboard --version latest && /tmp/openclaw/bin/openclaw --version'
 
+  linux-build-tools-failure:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - name: install.sh reports build-tool failures honestly
+        run: |
+          timeout --kill-after=10s 5m docker run --rm -i \
+            -v "$PWD/scripts/install.sh:/tmp/install.sh:ro" \
+            debian:bookworm \
+            bash -s <<'CONTAINER'
+          set -euo pipefail
+          export PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
+
+          cat > /usr/local/sbin/apt-get <<'STUB'
+          #!/bin/bash
+          for arg in "$@"; do
+            if [[ "$arg" == "build-essential" ]]; then
+              : > /tmp/build-tools-stub-triggered
+              echo "E: simulated package manager failure" >&2
+              exit 100
+            fi
+          done
+          for arg in "$@"; do
+            if [[ "$arg" == "update" ]]; then
+              exit 0
+            fi
+          done
+          echo "unexpected apt-get call: $*" >&2
+          exit 99
+          STUB
+
+          cat > /usr/local/bin/curl <<'STUB'
+          #!/bin/sh
+          echo "network blocked by failure-propagation lane" >&2
+          exit 97
+          STUB
+          chmod +x /usr/local/sbin/apt-get /usr/local/bin/curl
+
+          installer_status=0
+          bash /tmp/install.sh --no-onboard --no-prompt </dev/null > /tmp/out.log 2>&1 || installer_status=$?
+          cat /tmp/out.log
+
+          if [[ ! -f /tmp/build-tools-stub-triggered ]]; then
+            echo "stub did not trigger" >&2
+            exit 2
+          fi
+          if ! grep -aFq "Installing build tools failed" /tmp/out.log; then
+            echo "installer did not report the simulated build-tools failure" >&2
+            exit 2
+          fi
+          if grep -aFq "Build tools installed" /tmp/out.log; then
+            echo "REGRESSION: installer claimed success after failure" >&2
+            exit 1
+          fi
+          if (( installer_status == 0 )); then
+            echo "installer unexpectedly completed despite blocked package and network access" >&2
+            exit 3
+          fi
+          echo "ok: failure reported honestly"
+          CONTAINER
+
+  linux-non-root:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - name: install.sh as a non-root user
+        run: |
+          timeout --kill-after=30s 20m docker run --rm -i \
+            -v "$PWD/scripts/install.sh:/tmp/install.sh:ro" \
+            node:24-bookworm-slim \
+            bash -s <<'CONTAINER'
+          set -euo pipefail
+          apt-get update -qq
+          apt-get install -y -qq sudo
+          useradd --create-home --shell /bin/bash installer
+          printf '%s\n' 'installer ALL=(ALL) NOPASSWD:ALL' > /etc/sudoers.d/installer
+          chmod 0440 /etc/sudoers.d/installer
+
+          sudo -u installer -H bash <<'USER'
+          set -euo pipefail
+          test "$(id -u)" -ne 0
+          sudo -n true
+          initial_prefix="$(npm config get prefix)"
+          if [[ -w "$initial_prefix" || -w "$initial_prefix/lib" ]]; then
+            echo "initial npm prefix is writable; relocation path would not run" >&2
+            exit 1
+          fi
+          bash /tmp/install.sh --install-method npm --no-onboard --no-prompt --version latest
+          test "$(npm config get prefix)" = "$HOME/.npm-global"
+          "$HOME/.npm-global/bin/openclaw" --version
+          grep -Fxq 'export PATH="$HOME/.npm-global/bin:$PATH"' "$HOME/.bashrc"
+          echo "ok: non-root prefix relocation and bash PATH persistence verified"
+          USER
+          CONTAINER
+
+  fedora-installer:
+    name: Fedora installer (${{ matrix.user }})
+    strategy:
+      fail-fast: false
+      matrix:
+        user: [root, non-root]
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - name: install.sh on Fedora
+        env:
+          INSTALL_USER: ${{ matrix.user }}
+        run: |
+          if [[ "$INSTALL_USER" == "root" ]]; then
+            timeout --kill-after=30s 20m docker run --rm -i \
+              -v "$PWD/scripts/install.sh:/tmp/install.sh:ro" \
+              fedora:44 \
+              bash -s <<'CONTAINER'
+          set -euo pipefail
+          bash /tmp/install.sh --install-method npm --no-onboard --no-prompt --version latest
+          openclaw --version
+          CONTAINER
+          else
+            timeout --kill-after=30s 20m docker run --rm -i \
+              -v "$PWD/scripts/install.sh:/tmp/install.sh:ro" \
+              fedora:44 \
+              bash -s <<'CONTAINER'
+          set -euo pipefail
+          dnf install -y -q sudo shadow-utils
+          useradd --create-home --shell /bin/bash installer
+          printf '%s\n' 'installer ALL=(ALL) NOPASSWD: ALL' > /etc/sudoers.d/installer
+          chmod 0440 /etc/sudoers.d/installer
+
+          sudo -u installer -H bash <<'USER'
+          set -euo pipefail
+          test "$(id -u)" -ne 0
+          sudo -n true
+          bash /tmp/install.sh --install-method npm --no-onboard --no-prompt --version latest
+          test "$(npm config get prefix)" = "$HOME/.npm-global"
+          "$HOME/.npm-global/bin/openclaw" --version
+          grep -Fxq 'export PATH="$HOME/.npm-global/bin:$PATH"' "$HOME/.bashrc"
+          echo "ok: Fedora non-root install and PATH persistence verified"
+          USER
+          CONTAINER
+          fi
+
   macos-installer:
     runs-on: macos-15
     steps:
@@ -123,7 +267,14 @@ jobs:
         run: .\scripts\install.ps1 -DryRun -NoOnboard -InstallMethod npm
 
   sync-website:
-    needs: [static, linux-docker, macos-installer, windows-installer]
+    needs:
+      - static
+      - linux-docker
+      - linux-build-tools-failure
+      - linux-non-root
+      - fedora-installer
+      - macos-installer
+      - windows-installer
     if: >
       (github.event_name == 'push' && github.ref == 'refs/heads/main') ||
       (github.event_name == 'workflow_dispatch' && inputs.sync_website)