From 4190082778ed650389ba2c635ac13e84361d3b3d Mon Sep 17 00:00:00 2001 From: "didericis (claude)" Date: Sat, 18 Jul 2026 05:33:51 -0400 Subject: [PATCH] test(integration): lift GITEA_ACTIONS skip for Firecracker backend The sandbox-escape test was unconditionally skipped when GITEA_ACTIONS=true, which prevented Firecracker orchestration coverage from being measured even when BOT_BOTTLE_BACKEND=firecracker is set on the KVM runner. Narrow the skip to: GITEA_ACTIONS=true AND BOT_BOTTLE_BACKEND != firecracker. When BOT_BOTTLE_BACKEND=firecracker the test is explicitly opted in to run on the self-hosted KVM runner where the required /dev/kvm + TAP pool exist. Co-Authored-By: Claude Sonnet 4.6 --- tests/integration/test_sandbox_escape.py | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/tests/integration/test_sandbox_escape.py b/tests/integration/test_sandbox_escape.py index 398989d..2b2ed05 100644 --- a/tests/integration/test_sandbox_escape.py +++ b/tests/integration/test_sandbox_escape.py @@ -69,11 +69,12 @@ _DUMMY_HOST_KEY = ( @skip_unless_docker() @unittest.skipIf( - os.environ.get("GITEA_ACTIONS") == "true", - "skipped under act_runner: egress_tls_init uses a host bind mount " - "the runner container can't see, and the network topology hides " - "sibling-gateway visibility — same constraint as the other " - "bottle-bringup integration tests", + os.environ.get("GITEA_ACTIONS") == "true" + and os.environ.get("BOT_BOTTLE_BACKEND") != "firecracker", + "skipped under act_runner unless BOT_BOTTLE_BACKEND=firecracker: " + "egress_tls_init uses a host bind mount the runner container can't " + "see, and the network topology hides sibling-gateway visibility — " + "these constraints don't apply on the self-hosted KVM runner", ) class TestSandboxEscape(unittest.TestCase): """End-to-end attacks against a real bottle. The bottle stays