Unavoidable use of sudo on osx & linux runners

[dekimsey]

Summary

The action appears to always require the use sudo. On self-hosted runners that prohibits the use of sudo, this prevents the action from running.

Neither the defaults, or attempting to set specific paths will work. The error message is the same.

      - name: Setup Bats and bats libs
        id: setup-bats
        uses: bats-core/bats-action@42fcc8700f773c075a16a90eb11674c0318ad507 # 3.0.1
# Note: manually setting these paths has no effect, sudo is still required
#        with:
#          support-path: ${{ github.workspace }}/bats/bats-support
#          assert-path: ${{ github.workspace }}/bats/bats-assert
#          detik-install: false
#          file-install: false

sudo detection

I've looked into the code around how the base directory is being computed and how sudo is chosen, but I don't understand the intent. Looking at the set-paths step specifically, I cannot determine how it can ever not require sudo unless HOME is /.

          DEFAULT_BASE_DIR="/usr/lib"
          [[ "${DEFAULT_BASE_DIR}" == "$HOME"* ]] && CMD="" || CMD="sudo"

There doesn't seem to be any way to prevent this as the variable is set to a hard-coded value and then immediately checked.

[suggestion] Cache downloads, not install

It's possible that caching the download into the runner's tool cache directory instead via actions/github-script and @actions/tool-cache would allow the action to get all the benefits of caching without issues trying to use caching & sudo. Re-installing from the cached tool would be rather cheap and could reduce the complexity of the overall action.

Thank you!

[brokenpip3]

# Note: manually setting these paths has no effect, sudo is still required
#        with:
#          support-path: ${{ github.workspace }}/bats/bats-support
#          assert-path: ${{ github.workspace }}/bats/bats-assert
#          detik-install: false
#          file-install: false

are you sure about this? github workspace is indeed inside the home so sudo should not be called.
Can you provide an example ci where you reproduced the issue? I don't know why but I got a 404 on the image you posted, thanks

ps is the issue you made AI generated perhaps?

[mpern]

I ran into exactly the same issue just now.

The problem is step set-paths:

https://github.com/bats-core/bats-action/blob/main/action.yaml#L172-L184

        if [[ "$RUNNER_OS" == "macOS" ]]; then
          DEFAULT_BASE_DIR="/usr/local/lib"
          [[ "${DEFAULT_BASE_DIR}" == "$HOME"* ]] && CMD="" || CMD="sudo"
          TEMPDIR="/tmp"
        elif [[ "$RUNNER_OS" == "Windows" ]]; then
          DEFAULT_BASE_DIR="/c/Users/runneradmin"
          CMD=""
          TEMPDIR="$HOME/AppData/Local/Temp"
        else
          DEFAULT_BASE_DIR="/usr/lib"
          [[ "${DEFAULT_BASE_DIR}" == "$HOME"* ]] && CMD="" || CMD="sudo"
          TEMPDIR="/tmp"
        fi

DEFAULT_BASE_DIR is set to /usr/lib before the check, this can never work.

the dpath must be relative to $HOME by default, the same way as bats install DESTDIR="$HOME/.local/share/bats"

[brokenpip3]

hey @mpern did you tried to follow this instructions here?

I'm asking because we have a test with macos as well for that and it runs correctly so I want to understand if this is a corner case that we are not handling correctly :)

[mpern]

We use self hosted, hardened Linux runnerss. sudo is blocked.

The code I linked in my previous post always sets CMD=sudo

CMD is also not re-evaluated if I set a different library path eg support-path, CMD will remain sudo

https://github.com/bats-core/bats-action/blob/main/action.yaml#L192

And that's why it fails here

https://github.com/bats-core/bats-action/blob/main/action.yaml#L227