You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
refactor(ci): convert managed-policy e2e wrapper to Go - #1559
Converts hack/run-managed-policy-e2e.sh into the Go subcommand managed-policy-e2e in hack/microsandbox. The script is deleted. A non-Linux stub reports the command as unsupported.
Why
Moves the shell wrapper's mount-namespace, overlayfs, and policy-install logic into the Go CLI that already drives the other microsandbox suites. Same invariants and order; stderr messages unchanged.
Deviations from the script:
Lowercase fixture_root, namespace_id_file, and parent_mount_namespace exports are dropped. No consumer reads them.
hasOverlayMount requires upper and work on the same mountinfo line. The awk version accumulated them across lines.
The non-Linux stub lives in its own file, not a shared one.
Size: non-test changed lines against base are 521, above the 300-line target. Most of it is the new 347-line managed_policy_linux.go, plus the 96-line script deletion. The author accepted the overrun.
Open PR #1492 edits the same paths-filter block in pr-ci.yml, so a trivial rebase conflict is expected.
Validation
mise run cli:format: exit 0
mise run cli:lint:ci (host): 0 issues
GOOS=linux golangci-lint run ./hack/microsandbox/...: 0 issues
go vet for linux, darwin, windows: clean
Linux container (golang:1.26): go vet and go test -race -count=1 ./hack/microsandbox/ pass
Darwin go test -race -count=1 ./hack/microsandbox/: pass
Real unshare/overlayfs execution is covered only by CI, because the local host lacks Linux namespaces. The stages are tested through fakes.
CodeRabbit CLI
66e818d3e: 0 findings over 8 reviewed files. The rerun on 326709e5d was rate-limited (free tier, about 9 minutes until reset), so the current head has no CodeRabbit result yet.
Auto-merge
Not enabled. Draft PR for human review.
Next
Confirm the Linux CI job runs the managed-policy e2e path.
Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Converts
hack/run-managed-policy-e2e.shinto the Go subcommandmanaged-policy-e2einhack/microsandbox. The script is deleted. A non-Linux stub reports the command as unsupported.Why
Moves the shell wrapper's mount-namespace, overlayfs, and policy-install logic into the Go CLI that already drives the other microsandbox suites. Same invariants and order; stderr messages unchanged.
Deviations from the script:
fixture_root,namespace_id_file, andparent_mount_namespaceexports are dropped. No consumer reads them.hasOverlayMountrequires upper and work on the same mountinfo line. The awk version accumulated them across lines.Size: non-test changed lines against base are 521, above the 300-line target. Most of it is the new 347-line
managed_policy_linux.go, plus the 96-line script deletion. The author accepted the overrun.Open PR #1492 edits the same paths-filter block in
pr-ci.yml, so a trivial rebase conflict is expected.Validation
mise run cli:format: exit 0mise run cli:lint:ci(host): 0 issuesGOOS=linux golangci-lint run ./hack/microsandbox/...: 0 issuesgo vetfor linux, darwin, windows: cleangolang:1.26):go vetandgo test -race -count=1 ./hack/microsandbox/passgo test -race -count=1 ./hack/microsandbox/: passReal
unshare/overlayfs execution is covered only by CI, because the local host lacks Linux namespaces. The stages are tested through fakes.CodeRabbit CLI
66e818d3e: 0 findings over 8 reviewed files. The rerun on326709e5dwas rate-limited (free tier, about 9 minutes until reset), so the current head has no CodeRabbit result yet.Auto-merge
Not enabled. Draft PR for human review.
Next