bai/curriculum-project-hub
1
0
Fork 1
forked from EduCraft/curriculum-project-hub
Code Pull Requests Activity

fix(ci): keep node/npx on PATH for unprivileged sandbox proof

Browse Source
This commit is contained in:
洪佳荣
2026-07-30 12:09:20 +08:00
parent 3a46ebc54d
commit 315e4bd018
1 changed files with 4 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitea/workflows/hub-check.yml
+4 -2
View File
@@ -124,16 +124,18 @@ jobs:
fi fi
sudo install -d -o cphci -g cphci -m 0700 /w/t sudo install -d -o cphci -g cphci -m 0700 /w/t
REPO_ROOT="$(cd .. && pwd)" REPO_ROOT="$(cd .. && pwd)"
NODE_BIN_DIR="$(dirname "$(command -v node)")"
NPX_BIN="$(command -v npx)"
# Vitest/node_modules must be readable by cphci. # Vitest/node_modules must be readable by cphci.
sudo chown -R cphci:cphci "$REPO_ROOT/hub" sudo chown -R cphci:cphci "$REPO_ROOT/hub"
sudo -u cphci env \ sudo -u cphci env \
HOME="/home/cphci" \ HOME="/home/cphci" \
PATH="/usr/local/bin:/usr/bin:/bin" \ PATH="$NODE_BIN_DIR:/usr/local/bin:/usr/bin:/bin" \
CPH_SANDBOX_TEST_ROOT=/w/t \ CPH_SANDBOX_TEST_ROOT=/w/t \
/usr/bin/setpriv \ /usr/bin/setpriv \
--reuid=cphci --regid=cphci --clear-groups \ --reuid=cphci --regid=cphci --clear-groups \
--inh-caps=-all --bounding-set=-all --no-new-privs \ --inh-caps=-all --bounding-set=-all --no-new-privs \
bash -lc "cd '$REPO_ROOT/hub' && npx vitest run test/integration/agent-sandbox-linux.test.ts" bash -lc "cd '$REPO_ROOT/hub' && '$NPX_BIN' vitest run test/integration/agent-sandbox-linux.test.ts"
- name: Run unit tests - name: Run unit tests
run: npx vitest run test/unit run: npx vitest run test/unit