From 79fb7ff2fdc603f282eb4efae464cda1f96c8803 Mon Sep 17 00:00:00 2001 From: Stephen Waits Date: Thu, 29 Oct 2026 01:25:44 -0600 Subject: [PATCH] ci: the two-user job's copies belong to the server account Every run since P9a landed failed at the first adoption with "/tmp/fixture: Permission denied": the copies were owned by the runner (cp -a keeps the checkout's ownership) and the server account, which adopts them, could not take the source's lock. Both copies are now owned by the server account; the agent account keeps read access to the source's journal, which the test compares the moved books' head with. P9a's Done-when 1 (the job's first green run) is checked on this push. Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_01HS8WZziDnyxunC23MUxrLp --- .github/workflows/two-user.yml | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/.github/workflows/two-user.yml b/.github/workflows/two-user.yml index 4620e80..ceb000b 100644 --- a/.github/workflows/two-user.yml +++ b/.github/workflows/two-user.yml @@ -70,14 +70,19 @@ jobs: as_books "$WB" serve --root /srv/desktop > /tmp/desktop.log 2>&1 & wait_open /tmp/desktop.log sudo cp -a crates/ledger-cli/tests/fixtures/p2-served /tmp/fixture + # The server account adopts it, so it must own the copy: adoption + # takes the source's lock (root.rs lock_source), which the runner's + # ownership from the checkout refused it (the job's first runs). + sudo chown -R wanderbooks:wanderbooks /tmp/fixture as_books "$WB" books adopt /tmp/fixture --root /srv/desktop --id acme --yes as_books "$WB" close --root /srv/desktop - # The backup clone that is the transport (plan D-31): readable by + # The backup clone that is the transport (plan D-31): owned by the + # server account, which adopts it (and locks it), and readable by # the agent account, because the test reads its journal to know # the head the move must keep. sudo cp -a /srv/desktop/books/acme /tmp/source - sudo chown -R "$(id -u):$(id -g)" /tmp/source + sudo chown -R wanderbooks:wanderbooks /tmp/source sudo chmod -R a+rX /tmp/source # The server's machine: the same books, moved, behind `enforced`.