ewilliams28/openclaw
1
0
Fork 0
mirror of https://github.com/openclaw/openclaw.git synced 2026-08-25 03:45:46 -06:00
Code Issues Packages Projects Releases Wiki Activity

fix(qa): isolate packaged mock auth bootstrap (#126247)

Browse Source 
* fix(qa): isolate packaged mock auth config

Punchcard-Session: frost-orchard-lantern-ze
(cherry picked from commit 648bd40a4f)

* fix(qa): scrub inherited shell startup env

* fix(qa): block exported Bash functions
This commit is contained in:
Vincent Koc
2026-08-21 06:51:34 +08:00
committed by GitHub
parent 40e3ab8784
commit fa71a6f27b
6 changed files with 192 additions and 40 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/openclaw-release-telegram-qa.yml
+22 -6
View File
@@ -1530,9 +1530,19 @@ jobs:
"$RUNTIME_ROOT"/tmp/openclaw-"$RUNNER_UID"/openclaw-qa-suite-*) ;;
*) echo "SUT temp root escaped the workflow runtime root." >&2; exit 1 ;;
esac
requested_config_path="${OPENCLAW_CONFIG_PATH:?}"
config_path="${temp_root}/openclaw.json"
[[ -f "$config_path" && ! -L "$config_path" ]]
[[ "$(realpath -e "$config_path")" == "$config_path" ]]
case "$requested_config_path" in
"$config_path") ;;
"${temp_root}/state/qa-auth-bootstrap/openclaw.json")
[[ "${1:-}" == "models" && "${2:-}" == "auth" ]]
[[ -f "$requested_config_path" && ! -L "$requested_config_path" ]]
[[ "$(realpath -e "$requested_config_path")" == "$requested_config_path" ]]
;;
*) echo "SUT config path escaped the canonical or auth-bootstrap roots." >&2; exit 1 ;;
esac
capture_live_model_config "$config_path"
export OPENCLAW_QA_TEMP_ROOT="$temp_root"
@@ -1540,7 +1550,7 @@ jobs:
export OPENCLAW_HOME="$HOME"
export OPENCLAW_STATE_DIR="${temp_root}/state"
export OPENCLAW_OAUTH_DIR="${OPENCLAW_STATE_DIR}/credentials"
export OPENCLAW_CONFIG_PATH="$config_path"
export OPENCLAW_CONFIG_PATH="$requested_config_path"
export XDG_CACHE_HOME="${temp_root}/xdg-cache"
export XDG_CONFIG_HOME="${temp_root}/xdg-config"
export XDG_DATA_HOME="${temp_root}/xdg-data"
@@ -1575,6 +1585,9 @@ jobs:
chown -R "$SUT_UID:$SUT_GID" "$path"
chmod -R u=rwX,go= "$path"
done
if [[ "$requested_config_path" != "$config_path" ]]; then
[[ "$(stat -c '%F:%a:%u:%g' "$requested_config_path")" == "regular file:600:${SUT_UID}:${SUT_GID}" ]]
fi
if [[ -n "${OPENCLAW_BUNDLED_PLUGINS_DIR:-}" ]]; then
chown -R root:root "$OPENCLAW_BUNDLED_PLUGINS_DIR"
chmod -R a+rX,go-w "$OPENCLAW_BUNDLED_PLUGINS_DIR"
@@ -1640,6 +1653,7 @@ jobs:
export SUT_UID SUT_GID RUNNER_UID RUNNER_GID RUNNER_HOME RUNNER_TEMP_DIR
export CANDIDATE_ROOT CANDIDATE_ARTIFACTS_DIR RUNTIME_ROOT NODE_BIN
export PRELOAD_PATH RUNNER_SENTINEL TRUSTED_WORKSPACE EVIDENCE_ROOT
export CANONICAL_CONFIG_PATH="$config_path"
export boundary_mode generation command_file identity_file sandbox_file
export command_sha256 expected_env_keys_b64 sandbox_payload_b64
@@ -1801,8 +1815,12 @@ jobs:
runtime_stage=verify-runtime-files
[[ -r "$CANDIDATE_ROOT/dist/index.js" &&
! -w "$CANDIDATE_ROOT/dist/index.js" &&
-r "${OPENCLAW_CONFIG_PATH:?}" &&
! -w "$OPENCLAW_CONFIG_PATH" ]]
-r "${CANONICAL_CONFIG_PATH:?}" &&
! -w "$CANONICAL_CONFIG_PATH" ]]
if [[ "$OPENCLAW_CONFIG_PATH" != "$CANONICAL_CONFIG_PATH" ]]; then
[[ "${1:-}" == "models" && "${2:-}" == "auth" &&
-r "$OPENCLAW_CONFIG_PATH" && -w "$OPENCLAW_CONFIG_PATH" ]]
fi
[[ -d "${CANDIDATE_ARTIFACTS_DIR:?}" && -r "$CANDIDATE_ARTIFACTS_DIR" && -x "$CANDIDATE_ARTIFACTS_DIR" && ! -w "$CANDIDATE_ARTIFACTS_DIR" ]]
for writable_path in \
"${OPENCLAW_QA_TEMP_ROOT:?}/workspace" \
@@ -1839,6 +1857,7 @@ jobs:
unset \
CANDIDATE_ROOT \
CANDIDATE_ARTIFACTS_DIR \
CANONICAL_CONFIG_PATH \
EVIDENCE_ROOT \
NODE_BIN \
PRELOAD_PATH \
@@ -1880,9 +1899,6 @@ jobs:
else
runtime_node_args=("$runtime_candidate_root/dist/index.js" "$@")
fi
# Login Bash reads /etc/bash.bashrc with inherited nounset.
# Add PS1 only after the attested inbound env-key comparison.
export PS1=
runtime_stage=exec-runtime
exec "$runtime_node_bin" "${runtime_node_args[@]}"
'\'' openclaw-sut "$@"