From bae1c8779c0a872692b3c8bfd5e63aa6c8cdd666 Mon Sep 17 00:00:00 2001 From: "Mars.P" Date: Sat, 7 Nov 2026 23:14:00 +0800 Subject: [PATCH] Pin backend test lanes to ubuntu-24.04 ubuntu-latest moved to 26.04 on 2026-10-30. There an unprivileged bwrap works, so BubblewrapSandbox reports confinement as available and the local provider refuses local file:// sources without a server-prepared capability; the unit, integration and E2E suites assume the unconfined posture ubuntu-24.04 gave them (AppArmor denied userns). Confinement is covered by sandbox-isolation.yml. --- .github/workflows/backend-e2e.yml | 6 ++++-- .github/workflows/backend-integration.yml | 3 ++- .github/workflows/backend-unit.yml | 3 ++- .github/workflows/flake-hunt.yml | 6 ++++-- .github/workflows/large-capture.yml | 3 ++- 5 files changed, 14 insertions(+), 7 deletions(-) diff --git a/.github/workflows/backend-e2e.yml b/.github/workflows/backend-e2e.yml index 5a741b492..ad820378a 100644 --- a/.github/workflows/backend-e2e.yml +++ b/.github/workflows/backend-e2e.yml @@ -62,7 +62,8 @@ env: jobs: e2e-http: name: dotnet test (E2ETests · HTTP · Postgres) - runs-on: ubuntu-latest + # Pinned, not ubuntu-latest: on ubuntu-26.04 an unprivileged bwrap works, so the suites switch to confined mode; they assume the unconfined posture (confinement is covered by sandbox-isolation.yml) + runs-on: ubuntu-24.04 timeout-minutes: 30 services: @@ -244,7 +245,8 @@ jobs: e2e-worker: name: recurring jobs fire (worker host · Postgres) - runs-on: ubuntu-latest + # Pinned, not ubuntu-latest: on ubuntu-26.04 an unprivileged bwrap works, so the suites switch to confined mode; they assume the unconfined posture (confinement is covered by sandbox-isolation.yml) + runs-on: ubuntu-24.04 timeout-minutes: 20 services: diff --git a/.github/workflows/backend-integration.yml b/.github/workflows/backend-integration.yml index d79e0a76e..76bd2550c 100644 --- a/.github/workflows/backend-integration.yml +++ b/.github/workflows/backend-integration.yml @@ -37,7 +37,8 @@ env: jobs: integration: name: dotnet test (IntegrationTests · Postgres) - runs-on: ubuntu-latest + # Pinned, not ubuntu-latest: on ubuntu-26.04 an unprivileged bwrap works, so the suites switch to confined mode; they assume the unconfined posture (confinement is covered by sandbox-isolation.yml) + runs-on: ubuntu-24.04 # The suite itself takes ~25 min on a hosted runner, so 30 left no headroom: a slow runner was # cancelled mid-run and reported as a cancellation, not a failure. 45 keeps a real hang bounded # (--blame-hang-timeout below still dumps and aborts a single stuck test after 5 min). diff --git a/.github/workflows/backend-unit.yml b/.github/workflows/backend-unit.yml index 1d6d71ed9..c8c2217bf 100644 --- a/.github/workflows/backend-unit.yml +++ b/.github/workflows/backend-unit.yml @@ -41,7 +41,8 @@ env: jobs: unit: name: dotnet test (UnitTests) - runs-on: ubuntu-latest + # Pinned, not ubuntu-latest: on ubuntu-26.04 an unprivileged bwrap works, so the suites switch to confined mode; they assume the unconfined posture (confinement is covered by sandbox-isolation.yml) + runs-on: ubuntu-24.04 timeout-minutes: 20 steps: - uses: actions/checkout@v4 diff --git a/.github/workflows/flake-hunt.yml b/.github/workflows/flake-hunt.yml index 2751fca8a..8635e526d 100644 --- a/.github/workflows/flake-hunt.yml +++ b/.github/workflows/flake-hunt.yml @@ -40,7 +40,8 @@ jobs: unit: name: repeat (UnitTests) if: inputs.project == 'unit' - runs-on: ubuntu-latest + # Pinned, not ubuntu-latest: on ubuntu-26.04 an unprivileged bwrap works, so the suites switch to confined mode; they assume the unconfined posture (confinement is covered by sandbox-isolation.yml) + runs-on: ubuntu-24.04 timeout-minutes: 180 steps: - uses: actions/checkout@v4 @@ -108,7 +109,8 @@ jobs: integration: name: repeat (IntegrationTests · Postgres) if: inputs.project == 'integration' - runs-on: ubuntu-latest + # Pinned, not ubuntu-latest: on ubuntu-26.04 an unprivileged bwrap works, so the suites switch to confined mode; they assume the unconfined posture (confinement is covered by sandbox-isolation.yml) + runs-on: ubuntu-24.04 timeout-minutes: 180 env: diff --git a/.github/workflows/large-capture.yml b/.github/workflows/large-capture.yml index 9c453fa74..3c2adbcf4 100644 --- a/.github/workflows/large-capture.yml +++ b/.github/workflows/large-capture.yml @@ -51,7 +51,8 @@ env: jobs: large-capture: name: dotnet test (LargeCapture · 4 GiB · Postgres) - runs-on: ubuntu-latest + # Pinned, not ubuntu-latest: on ubuntu-26.04 an unprivileged bwrap works, so the suites switch to confined mode; they assume the unconfined posture (confinement is covered by sandbox-isolation.yml) + runs-on: ubuntu-24.04 # Three nested deadlines, ordered so the INNERMOST always fires first and the diagnosis is readable: the in-test # CancellationTokenSource at 40 m (AgentRunLogFourGibibyteCaptureFlowTests.cs) throws an XunitException naming the # stream and the SQL to inspect it; --blame-hang-timeout at 50 m only catches a genuinely wedged process, and