Repository navigation
Qualify installer permissions and accelerate gated testing - #67
Merged
Merged
Conversation
Reject foreign Unix ancestor ownership and Windows hard-linked artifacts. Align MSI ownership with the registered service path. Exercise real Unix identities, restricted Windows tokens, native CI and explicitly opted-in SYSTEM installer checks. Docs: paired permission qualification matrix in Printmaster-Org/docs.printmaster.work; live platform evidence pending Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Use one Node runner for discovered Go modules, lint, Jest, all browsers and explicitly selected integration, isolated Docker E2E, native/root and docs suites. Preserve skip/failure visibility and share suite commands with CI/build aliases. Remove eight unreferenced root helper scripts and retain release/build/package tools. Docs: paired shared-runner guide updates pending in Printmaster-Org/docs.printmaster.work Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Document the shared test baseline and explicit optional suites, keep Unix root examples platform-correct, and make legacy build aliases log the Node command they execute. Docs: Printmaster-Org/docs.printmaster.work@179a93b Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Scope Docker context discovery to the PostgreSQL Go subprocess so combined integration and Docker suites preserve the Docker CLI context. Cover endpoint isolation and verify both actual suites together on Windows. Docs: Printmaster-Org/docs.printmaster.work@179a93b Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Stop subsequent checks, modules and suites after a command fails. Mark unstarted suites NOT RUN while preserving Docker failure cleanup. Add explicit keep-going mode and regression coverage for both behaviors. Docs: Printmaster-Org/docs.printmaster.work@5250bae Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…ests Start three independent Playwright shards at two workers each alongside Jest, Docker/native checks and a discovered Go-module matrix. Gate normal builds on lint/Go/JS and releases on all nonprivileged suites before version changes. Remove duplicate test orchestration and cover shell gate ordering and failure propagation. Docs: Printmaster-Org/docs.printmaster.work@a81431d Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
The three-shard run passed in six minutes but its WebKit shard took twice as long as Chromium. Use six independent shards with unchanged two-worker limits, complete required coverage and no retries. Docs: Printmaster-Org/docs.printmaster.work@fb13041 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Collaborator
Author
|
Paired documentation: Printmaster-Org/docs.printmaster.work#13 . Source merges first; docs follows after checks. Source commit history will be preserved with a merge commit. |
There was a problem hiding this comment.
🟡 Changes recommended
Unresolved safety and validation issues prevent the shared gates from reliably enforcing their intended boundaries.
3 open issues
What changed in this PR
Strengthens PrintMaster installer permissions and centralizes test gates across local builds, releases, and CI.
Changes:
- Hardens updater paths and adds native permission checks.
- Unifies test execution and validates releases before version changes.
- Parallelizes CI and removes unused helper scripts.
| File | Description |
|---|---|
| version.sh | Removes unused version helper. |
| version.ps1 | Removes unused version helper. |
| update.sh | Removes unused update helper. |
| update.ps1 | Removes unused update helper. |
| tests/docker-compose.e2e.yml | Isolates environments and preserves test exit status. |
| tests.sh | Adds Bash test entry point. |
| tests.ps1 | Adds PowerShell test entry point. |
| status.sh | Removes unused status helper. |
| status.ps1 | Removes unused status helper. |
| scripts/run-tests.test.js | Tests runner selection, failures, and isolation. |
| scripts/run-tests.js | Centralizes test suite execution. |
| scripts/release-workflow.test.js | Checks required permission qualification. |
| scripts/msi-paths.test.js | Verifies canonical MSI paths. |
| scripts/build-gates.test.js | Tests build and release gate ordering. |
| scripts/beta-release.test.js | Updates build fixture parameters. |
| release.sh | Runs validation before version changes. |
| release.ps1 | Runs validation before version changes. |
| CONTRIBUTING.md | Documents prerequisites and shared gates. |
| commit.sh | Removes unused commit helper. |
| commit.ps1 | Removes unused commit helper. |
| build/windows/msi/printmaster-agent.wxs | Aligns MSI with protected Agent path. |
| build.sh | Uses shared build validation. |
| build.ps1 | Uses shared build validation. |
| agent/service_binary_windows.go | Rejects hard-linked service executables. |
| agent/service_binary_windows_test.go | Tests executable hard-link rejection. |
| agent/autoupdate/permissions_windows.go | Validates updater file link identity. |
| agent/autoupdate/permissions_windows_test.go | Tests junction and hard-link rejection. |
| agent/autoupdate/permissions_unix.go | Rejects foreign-owned ancestors. |
| agent/autoupdate/permissions_unix_test.go | Tests ancestor ownership enforcement. |
| agent/autoupdate/permissions_token_windows_test.go | Tests restricted-token access denial. |
| agent/autoupdate/permissions_live_windows_test.go | Adds opt-in installed MSI permission checks. |
| agent/autoupdate/permissions_identity_unix_test.go | Tests separate Unix identity boundaries. |
| agent/autoupdate/permissions_crossfs_linux_test.go | Tests cross-filesystem replacement rejection. |
| .vscode/tasks.json | Routes test tasks through shared runner. |
| .github/workflows/installer-permissions.yml | Adds cross-platform permission qualification. |
| .github/workflows/ci.yml | Parallelizes suites and browser shards. |
| .github/copilot-instructions.md | Updates testing workflow guidance. |
| .dockerignore | Excludes new test wrappers. |
Review effort: Balanced
| this.env = { ...process.env }; | ||
| // An inherited rehearsal opt-in must not turn a baseline into a live install. | ||
| for (const key of Object.keys(this.env)) { | ||
| if (key.startsWith('PRINTMASTER_LIVE_')) delete this.env[key]; |
Comment on lines
+197
to
+198
| this.command(o.hugo, ['--gc', '--minify', '--panicOnWarning'], { cwd: directory }); | ||
| this.command(process.execPath, [path.join('scripts', 'check-site.mjs'), 'public'], { cwd: directory }); |
| BUILD_TIME: ${BUILD_TIME:-2026-01-01T00:00:00Z} | ||
| GIT_COMMIT: ${GIT_COMMIT:-e2e-test} | ||
| container_name: pm-e2e-server | ||
| hostname: server |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Qualify protected installer paths and centralize local/build/release test gates while reducing observed full CI elapsed time from 9m26s to 3m27s.
Changes
Testing
Scope and limits
Includes the preceding installer-permission qualification commit, not only test scheduling. MSI repair/transaction recovery, old-version migration, live macOS launchd lifecycle and remaining stable-release gates are not claimed qualified. No release/version bump, production trust provisioning or unattended activation. Existing null publisher root still blocks trusted release packaging.
Merge with a merge commit to preserve source hashes cited in paired documentation. Paired docs PR follows.