screencapture grant: bash on ad-hoc roles + retry transient skips (RELOPS-2454) - #78
Merged
Merged
Conversation
… back The step runs right after the bootstrap sentinel, when cltbld's autologin session may not own the console yet. That exit-3 skip used to be accepted on the first try, returning the host to service with no Screen Recording grant and nothing retrying it. Retry "no console session" and "running a task" for up to 10 x 30s first; permanent skips (SIP off) still return immediately. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…-hoc
Roles without taskcluster_signed_binaries -- gecko_t_osx_1500_m4_staging among
them -- run ad-hoc worker builds, and the payload treated that as a hard fail.
Every staging reprovision therefore ended in ReprovisionError at the last step,
before /bin/bash (the failure-screenshot LaunchAgent) was granted.
Ad-hoc worker grants really are useless (Identifier=a.out never satisfies a code
requirement), so skip only the worker binaries: empty CLIENTS, tell the
AppleScript not to tick them, and still add + verify /bin/bash. The
empty-array loops use ${arr[@]+...} so they stay legal under bash 3.2 set -u.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two fixes so the Screen Recording grant step works for provision and reprovision on every m4 role.
1. Ad-hoc worker binaries no longer hard-fail the step
Roles without
taskcluster_signed_binariesrun ad-hoc worker builds. That covers everything exceptgecko_t_osx_1500_m4andgecko_t_osx_2600_m4, and includesgecko_t_osx_1500_m4_staging. The payload treated ad-hoc binaries asfail, so every staging reprovision ended inReprovisionErrorat the last step, before/bin/bash(added in #77) was granted.A grant for an ad-hoc worker binary is useless, since
Identifier=a.outnever satisfies a code requirement. So the payload now skips only the worker binaries and still adds and verifies/bin/bash, which the failure-screenshot LaunchAgent needs whatever the worker's signing.2. Transient skips are retried before the host is handed back
The step runs right after the bootstrap sentinel, when cltbld's autologin session may not own the console yet. Before, that exit-3 skip was accepted on the first attempt, so the host went back to service with no grant and nothing retried it.
Tests
opstripped from PATH, matching CI; ruff is clean.${arr[@]+...}empty-array guard on the macOS/bin/bash3.2.57 underset -u, and the AppleScript argv switch (0 → no worker checkboxes, 1 → both).Validation plan
Reprovision one staging host (m4-112/113) after merge. Expected: the step logs "granting /bin/bash only" and ends with
/bin/bash 2/…/0, the first run of #77's "+" flow inside a real reprovision. Companion detector change: ronin_puppet#1426.🤖 Generated with Claude Code