test(integration): skip sandbox-escape suite under act_runner #52

2026-05-26T23:04:07-04:00

didericis commented

2026-05-26 23:04:07 -04:00

Summary

PRD 0022's sandbox-escape suite needs a skipIf(GITEA_ACTIONS == "true") guard at the class level — the same one every other bottle-bringup integration test already carries. Under act_runner the runner container shares the host docker socket but not the host filesystem, so pipelock_tls_init's CA-file bind mount lands somewhere the runner can't see, and the suite fails with pipelock tls init did not produce ca files in …/pipelock-ca.

The CI failure on the post-merge main build (run #445, integration job) is exactly this. Adding the skip mirrors the constraint already enforced by test_pipelock_apply.py, test_pipelock_blocks_secret_post.py, et al.

Locally:

GITEA_ACTIONS=true python3 -m unittest tests.integration.test_sandbox_escape -v
Ran 5 tests in 0.000s
OK (skipped=5)

## Summary PRD 0022's sandbox-escape suite needs a `skipIf(GITEA_ACTIONS == "true")` guard at the class level — the same one every other bottle-bringup integration test already carries. Under act_runner the runner container shares the host docker socket but not the host filesystem, so `pipelock_tls_init`'s CA-file bind mount lands somewhere the runner can't see, and the suite fails with `pipelock tls init did not produce ca files in …/pipelock-ca`. The CI failure on the post-merge `main` build (run #445, integration job) is exactly this. Adding the skip mirrors the constraint already enforced by `test_pipelock_apply.py`, `test_pipelock_blocks_secret_post.py`, et al. Locally: ``` GITEA_ACTIONS=true python3 -m unittest tests.integration.test_sandbox_escape -v Ran 5 tests in 0.000s OK (skipped=5) ```

didericis added 1 commit 2026-05-26 23:04:07 -04:00

test(integration): skip sandbox-escape suite under act_runner

test / unit (pull_request) Successful in 18s

Details

test / integration (pull_request) Successful in 1m10s

Details

5c17fcdf90

The Gitea CI runner shares the host docker socket but not its
filesystem, so pipelock_tls_init's host bind-mount path for CA
files is invisible to the runner container — the same constraint
that already gates the other bottle-bringup integration tests.

PRD 0022's test suite was missing this guard; it failed on the
post-merge main build with "pipelock tls init did not produce ca
files". Mirror the existing skipIf pattern at the class level.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

didericis merged commit e8a14fd860 into main

2026-05-26 23:06:48 -04:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: didericis/bot-bottle#52