fix(ci): keep node/npx on PATH for unprivileged sandbox proof

2026-07-30 12:09:20 +08:00
parent 3a46ebc54d
commit 315e4bd018
1 changed files with 4 additions and 2 deletions
@@ -124,16 +124,18 @@ jobs:
          fi
          sudo install -d -o cphci -g cphci -m 0700 /w/t
          REPO_ROOT="$(cd .. && pwd)"
+          NODE_BIN_DIR="$(dirname "$(command -v node)")"
+          NPX_BIN="$(command -v npx)"
          # Vitest/node_modules must be readable by cphci.
          sudo chown -R cphci:cphci "$REPO_ROOT/hub"
          sudo -u cphci env \
            HOME="/home/cphci" \
-            PATH="/usr/local/bin:/usr/bin:/bin" \
+            PATH="$NODE_BIN_DIR:/usr/local/bin:/usr/bin:/bin" \
            CPH_SANDBOX_TEST_ROOT=/w/t \
            /usr/bin/setpriv \
              --reuid=cphci --regid=cphci --clear-groups \
              --inh-caps=-all --bounding-set=-all --no-new-privs \
-              bash -lc "cd '$REPO_ROOT/hub' && npx vitest run test/integration/agent-sandbox-linux.test.ts"
+              bash -lc "cd '$REPO_ROOT/hub' && '$NPX_BIN' vitest run test/integration/agent-sandbox-linux.test.ts"

      - name: Run unit tests
        run: npx vitest run test/unit