- CI now builds the image locally on the (arm64) runner and runs
scripts/verify-image-socktop-flags.sh before pushing: every --flag the
restricted/session shells pass must be documented by the socktop
binary actually installed in the image. Catches the 0.3.9 failure
class (cached apt layer shipping a pre-flag socktop) at build time.
- Manifest adds CHOWN/DAC_OVERRIDE/FOWNER alongside SETUID/SETGID:
with ALL dropped, uid 0 has no implicit file privilege and
prepare_demo_home crash-looped on the demo-owned 700 home dir.
Sessions still run with zero capabilities via setpriv.
- Agent liveness probe uses /proc instead of kill -0: without CAP_KILL
even root gets EPERM signalling the socktop-user agent, so the old
check false-alarmed in the pod logs.
- 0.3.11
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The act runner uses a minimal PATH for inline run: steps that does not
include ~/.cargo/bin. Add it explicitly via both export PATH and
GITHUB_PATH so rustup/cargo are available in the setup step and all
subsequent steps.
The Swatinem/rust-cache action bundled in actions-rust-lang/setup-rust-toolchain@v1
was updated to require node24, which is not supported by the self-hosted act
runner (v0.2.6). Even with cache:false, act eagerly loads pre-steps for all
nested actions regardless of conditions, and the node24 incompatibility in
the rust-cache pre-step caused the parent step to be marked as failed —
skipping Run tests entirely.
Replace both test and lint toolchain setup steps with direct rustup shell
commands to eliminate the dependency on the composite action entirely.
jasonwitty
jason