From 385eaca98bb8e6395a76004ef42e834025b338f6 Mon Sep 17 00:00:00 2001 From: Simone Date: Wed, 22 Jul 2026 20:38:32 +0200 Subject: [PATCH] fix(tools): run the publish guard as the committing user, not ci-runner Documented with `sudo -u ci-runner`, copied from the neighbouring tools that call the Gitea API. Wrong here: the guard fetches, fetching writes .git/FETCH_HEAD, and that file belongs to the committing user -- so as ci-runner it died with "impossibile aprire '.git/FETCH_HEAD': Permesso negato" before comparing anything. A guard that cannot run is worse than no guard, since the failure looks like infrastructure noise rather than an answer. The question it asks is "does what I have match what is published", so it belongs to whoever holds the working tree. --- docs/RUNBOOK-PhaseC.md | 6 +++++- plans/cargo-dependency-cache.md | 4 ++-- tools/ci-action-published.py | 6 +++++- 3 files changed, 12 insertions(+), 4 deletions(-) diff --git a/docs/RUNBOOK-PhaseC.md b/docs/RUNBOOK-PhaseC.md index def70c3..e6f21eb 100644 --- a/docs/RUNBOOK-PhaseC.md +++ b/docs/RUNBOOK-PhaseC.md @@ -621,11 +621,15 @@ while a downstream repo chased a snapshot-name bug that was fixed locally. Check before announcing any action change as done: ```bash -sudo -u ci-runner /opt/ci/venv/bin/python tools/ci-action-published.py +/opt/ci/venv/bin/python tools/ci-action-published.py # OK — .gitea/ matches origin/main; CI runs what you see here. # FAIL — lists the drifted files, exit 1 ``` +Run it as the user who commits, **not** under `sudo -u ci-runner`: it fetches, +which needs write access to `.git`, and `.git/FETCH_HEAD` here belongs to the +committing user. + It catches both ways of being unpublished, committed-but-unpushed and edited-but-uncommitted, and fetches first so it compares against the server rather than a stale remote-tracking ref (`--no-fetch` to skip the network). diff --git a/plans/cargo-dependency-cache.md b/plans/cargo-dependency-cache.md index afa1c4c..e37589c 100644 --- a/plans/cargo-dependency-cache.md +++ b/plans/cargo-dependency-cache.md @@ -1154,7 +1154,7 @@ Windows runner or by reading the branch — but record which you did. git add .gitea/actions/local-ci-build/action.yml git commit -m "feat(action): cargo-cache input, cold on release tags" git push origin main -sudo -u ci-runner /opt/ci/venv/bin/python tools/ci-action-published.py +/opt/ci/venv/bin/python tools/ci-action-published.py ``` Expected: `OK — .gitea/ matches origin/main`. Committing is not deploying for @@ -1357,7 +1357,7 @@ is available as a per-workflow override. git add plans/cargo-dependency-cache-measurements.md docs/RUNBOOK-PhaseC.md TODO.md git commit -m "docs(cache): end-to-end numbers for the cargo dependency cache" git push origin main -sudo -u ci-runner /opt/ci/venv/bin/python tools/ci-action-published.py +/opt/ci/venv/bin/python tools/ci-action-published.py ``` --- diff --git a/tools/ci-action-published.py b/tools/ci-action-published.py index 7e91a13..6e53678 100755 --- a/tools/ci-action-published.py +++ b/tools/ci-action-published.py @@ -11,8 +11,12 @@ That is not hypothetical: 59 commits sat unpushed for a day while a downstream repo debugged a snapshot-name bug we had already fixed locally (thread entry furyrs#14, 2026-07-22). +Run it as the user who commits, not as ``ci-runner``: it fetches, which needs +write access to ``.git``, and the question it answers is "does what I have +match what is published". + Usage: - sudo -u ci-runner /opt/ci/venv/bin/python tools/ci-action-published.py + /opt/ci/venv/bin/python tools/ci-action-published.py ... --ref main --no-fetch # skip the network round-trip Exit 0 when the published `.gitea/` tree matches this working tree, 1 when it