From 93641f27c41fea80ca48c9b1e30a197899be30a8 Mon Sep 17 00:00:00 2001 From: rob thijssen Date: Wed, 16 Sep 2026 08:42:55 +0300 Subject: [PATCH] fix: preflight the sudoers grants by destination, not by command path MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit oolon is a shared edge proxy. blackbeard.observer and others already grant gitea_ci `/usr/bin/rsync` into their own webroots, so checking for the bare command path passed on somebody else's grant — and the deploy would then fail at the rsync, halfway, having already been told everything was fine. The grants are destination-qualified in script/infra-setup.sh for exactly this reason; the check now matches them. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_012uDUodEcRbBwNRi3UCmw8f --- .gitea/workflows/deploy.yaml | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/.gitea/workflows/deploy.yaml b/.gitea/workflows/deploy.yaml index f716d13..947bc39 100644 --- a/.gitea/workflows/deploy.yaml +++ b/.gitea/workflows/deploy.yaml @@ -114,10 +114,14 @@ jobs: set -euo pipefail allowed=$(ssh "$EDGE_HOST" sudo -n -l 2>/dev/null || true) missing=0 + # Destination-qualified, not just the command path. oolon is a SHARED + # proxy: blackbeard.observer and others already grant gitea_ci + # /usr/bin/rsync into *their* webroots, so a bare command check passes + # on somebody else's grant and the deploy then fails at the rsync. for cmd in \ - "/usr/bin/rsync" \ - "/usr/sbin/restorecon" \ - "/usr/sbin/nginx" \ + "/usr/bin/rsync * $WEBROOT/" \ + "/usr/sbin/restorecon -R $WEBROOT" \ + "/usr/sbin/nginx -t" \ "/usr/bin/systemctl reload nginx" do if ! grep -qF -- "$cmd" <<<"$allowed"; then