ci: chown root-owned E2E leftovers back to runner user in Clean step#913
Merged
Conversation
The containerized E2E steps run as root and create root-owned dirs in the mounted workspace beyond the fixed rm list (data/ incl. data/huggingface, output/, pp_simulation_result/, .git internals). The next run's actions/checkout runs as the runner user and fails with EACCES while deleting them (e.g. rmdir data/huggingface). After the existing rm/find cleanup, chown any remaining root-owned files back to the runner user so the next checkout can remove them. Co-authored-by: Cursor <[email protected]>
Contributor
There was a problem hiding this comment.
Pull request overview
This PR hardens the CI workspace cleanup by adding a post-clean “safety net” to address root-owned files and directories created by containerized E2E runs, preventing subsequent actions/checkout failures due to permission errors during workspace deletion.
Changes:
- Expanded the Clean step’s documentation to include E2E-generated root-owned directories that can break subsequent checkouts.
- Added a cleanup fallback that
chowns any remaining root-owned workspace files back to the runner user based on the workspace directory’s UID:GID.
Comment on lines
+599
to
+600
| owner="$(stat -c '%u:%g' "${GITHUB_WORKSPACE}" 2>/dev/null)" | ||
| [ -n "$owner" ] && find "${GITHUB_WORKSPACE}" -user 0 -exec chown "$owner" {} + 2>/dev/null |
The end-of-run Clean step only runs when a job actually reaches it; a runner crash/reboot/OOM or a cancellation past the grace period can leave root-owned files (E2E data/, output/, .pytest_cache, ...) that make the NEXT run's actions/checkout fail with EACCES. Add a step before checkout that chowns any root-owned files back to the runner user (as root via docker, reusing the UT container when present, else a throwaway one), so each run self-heals regardless of how the previous one ended. Co-authored-by: Cursor <[email protected]>
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.
Comments suppressed due to low confidence (2)
.github/workflows/ci.yaml:251
chownis executed on paths returned byfindwithout--and without-h. If a root-owned symlink exists under the workspace,chownwill dereference it and can change ownership of the symlink target (potentially outside the workspace mount). Usechown -h(don’t dereference symlinks) and pass--before the path list to avoid filenames being parsed as options.
FIX="find '$CWS' -user 0 -exec chown $owner {} + 2>/dev/null; true"
.github/workflows/ci.yaml:626
- The safety-net
find ... -exec chown ...should avoid dereferencing symlinks and should pass--so filenames beginning with-can’t be interpreted as options. Without this, a root-owned symlink under the workspace could cause ownership changes on the symlink target.
owner="$(stat -c '%u:%g' "${GITHUB_WORKSPACE}" 2>/dev/null)"
[ -n "$owner" ] && find "${GITHUB_WORKSPACE}" -user 0 -exec chown "$owner" {} + 2>/dev/null
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The containerized E2E steps run as root and create root-owned dirs in the mounted workspace beyond the fixed rm list (data/ incl. data/huggingface, output/, pp_simulation_result/, .git internals). The next run's actions/checkout runs as the runner user and fails with EACCES while deleting them (e.g. rmdir data/huggingface). After the existing rm/find cleanup, chown any remaining root-owned files back to the runner user so the next checkout can remove them.