Repository navigation
CI: set Cacti fixture ownership to runner:www-data in Setup Permissions - #100
Merged
Merged
Conversation
Composer runs as the runner user in a later CI step and calls touch() while generating the fixture autoloader; utime() only succeeds for the file owner, so the runner user must own the tree. www-data is retained as group and ownership is handed back before polling. Mirrors the fix in Cacti/plugin_evidence#63. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
There was a problem hiding this comment.
🟢 Approval recommended
No active review issues are recorded for the CI fixture ownership change.
No open issues 🎉
What changed in this PR
Updates the Cacti fixture ownership in plugin CI so Composer runs as the file owner while www-data retains group access.
Changes:
- Changes ownership from
www-data:runnertorunner:www-datainSetup Permissions. - Adds a comment explaining the ownership requirement and later handoff before polling.
| File | Description |
|---|---|
.github/workflows/plugin-ci-workflow.yml |
Adjusts fixture ownership for Composer and documents the rationale. |
Review effort: Balanced
The AuthAuditIngestionTest fixtures used hard-coded 2026-07-25 timestamps. New-row ingestion in audit_poll_user_log() only selects source rows newer than the retention lower bound (audit_retention, default 90 days). Once wall-clock time advanced 90 days past the fixed fixture date (2026-10-23), every new-row ingestion scenario selected nothing, so six tests that expect events began failing while scenarios that assert emptiness or use the cutoff-free pending/retry path kept passing. Anchor the affected fixtures to a fixed-but-recent UTC date derived from the current time via a cached audit_auth_test_recent_datetime() helper, so the fixtures stay inside the retention window no matter when the suite runs. This mirrors the existing time()-relative pattern already used by the timezone-stability test. Pending/retry fixtures that carry an explicit source_epoch and bypass the cutoff are left unchanged. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
The concurrent-poller, lost-claim, and retention-exclusion scenarios still carried hard-coded 2026-07-25 / June dates. At the current test clock those rows are filtered by the 90-day (and 30-day) retention cutoff before reaching the deduplication, claim-conflict, and admission branches they are meant to cover, so a reject-all implementation would pass them. Derive the fixture times from the test clock via the existing audit_auth_test_recent_datetime() helper (and a clock-relative old row) so the in-window rows stay inside the retention window, and add admitted-path assertions: - concurrent poller: positive control proves the same in-window row is ingested once the concurrent claim is cleared. - lost claim: positive control proves the row is ingested once the claim race is won. - retention exclusion: assert the in-window 'recent' row IS recorded while the pre-cutoff 'old' row is dropped. Verified a reject-all poll fails all three scenarios. Full suite: 125 passed (596 assertions). Test-only change; no product code touched. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
|
xmacan
approved these changes
Nov 3, 2026
TheWitness
pushed a commit
that referenced
this pull request
Nov 3, 2026
Composer generates the fixture autoloader as the runner user in a later step and calls touch(), whose utime() only succeeds for the file owner. Give the runner user ownership of the Cacti tree during Setup Permissions (www-data retains group access); ownership is handed back to www-data before polling. Mirrors the already-merged workflow fix from #100 so this branch can clear CI. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
somethingwithproof
pushed a commit
that referenced
this pull request
Nov 3, 2026
* Fix time-bomb in authentication audit ingestion tests The AuthAuditIngestionTest fixtures used hard-coded 2026-07-25 timestamps. New-row ingestion in audit_poll_user_log() only selects source rows newer than the retention lower bound (audit_retention, default 90 days). Once wall-clock time advanced 90 days past the fixed fixture date (2026-10-23), every new-row ingestion scenario selected nothing, so six tests that expect events began failing while scenarios that assert emptiness or use the cutoff-free pending/retry path kept passing. Anchor the affected fixtures to a fixed-but-recent UTC date derived from the current time via a cached audit_auth_test_recent_datetime() helper, so the fixtures stay inside the retention window no matter when the suite runs. This mirrors the existing time()-relative pattern already used by the timezone-stability test. Pending/retry fixtures that carry an explicit source_epoch and bypass the cutoff are left unchanged. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Address review: exercise admitted ingestion paths in time-bomb fixtures The concurrent-poller, lost-claim, and retention-exclusion scenarios still carried hard-coded 2026-07-25 / June dates. At the current test clock those rows are filtered by the 90-day (and 30-day) retention cutoff before reaching the deduplication, claim-conflict, and admission branches they are meant to cover, so a reject-all implementation would pass them. Derive the fixture times from the test clock via the existing audit_auth_test_recent_datetime() helper (and a clock-relative old row) so the in-window rows stay inside the retention window, and add admitted-path assertions: - concurrent poller: positive control proves the same in-window row is ingested once the concurrent claim is cleared. - lost claim: positive control proves the row is ingested once the claim race is won. - retention exclusion: assert the in-window 'recent' row IS recorded while the pre-cutoff 'old' row is dropped. Verified a reject-all poll fails all three scenarios. Full suite: 125 passed (596 assertions). Test-only change; no product code touched. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * CI: set Cacti fixture ownership to runner:www-data in Setup Permissions Composer generates the fixture autoloader as the runner user in a later step and calls touch(), whose utime() only succeeds for the file owner. Give the runner user ownership of the Cacti tree during Setup Permissions (www-data retains group access); ownership is handed back to www-data before polling. Mirrors the already-merged workflow fix from #100 so this branch can clear CI. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: TheWitness <copilot@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Aligns the
Setup Permissionsstep of the plugin CI workflow with the fix from Cacti/plugin_evidence#63.The step previously chowned the Cacti fixture tree to
www-data:runner. Composer runs as therunneruser in a later step and callstouch()while generating the fixture autoloader;utime()only succeeds for the file owner, so therunneruser must own the tree. This changes ownership torunner:www-data(www-dataretained as the group), with an explanatory comment.Change
Fleet-wide consistency update across
plugin_*repositories.Co-authored-by: Copilot 223556219+Copilot@users.noreply.github.com