Repository navigation
Main->Stable: don't rely on sudo --preserve-env (ubuntu-26.04 / sudo-rs) (#332) - #333
Merged
Merged
Conversation
…/ sudo-rs) (#332) ## Problem GitHub is rolling `ubuntu-latest` to `ubuntu-26.04`, which ships **sudo-rs** as the default `sudo`. sudo-rs ignores a bare `--preserve-env`, so every step using `lib/ci/default-shell` loses its environment after the user switch and dies immediately: ``` sudo: preserving the entire environment is not supported, '--preserve-env' is ignored .../tacos-gha/lib/ci/bin/default-shell-post-sudo: line 8: DEBUG: unbound variable ``` Example: getsentry/ops run 39496933888 (`Image: ubuntu-26.04`, fails in "List Slices" → "show GHA contexts"). The last green runs earlier today were on `ubuntu-24.04`. ## Fix - New `lib/ci/bin/sudo-keep-env [SUDO_OPTION...] -- COMMAND...`: snapshots `env -0` and passes it through explicitly via `env NAME=VALUE...` after switching user. Works the same under classic sudo and sudo-rs, and also covers vars classic sudo refuses to keep (e.g. `PATH`), so the old `env PATH="$PATH"` workaround goes away. - `lib/ci/default-shell` uses it instead of `sudo --preserve-env --set-home ... env PATH=...`. `HOME` now comes from the caller; `set-username-and-hostname` already sets `HOME` to the new user's home, so the value doesn't change in practice. - `sudo-ssh-agent` / `sudo-ssh-add` used `sudo -E`, which has the same problem (`SSH_AUTH_SOCK` would get dropped). They use the helper now too. ## Rollout note Consumers (e.g. getsentry/ops) pin the reusable workflow by SHA but check out the scripts from `tacos_gha_ref: refs/heads/stable`. Once this is promoted main→stable, it takes effect with **no consumer change**. ## Verification - Local: a fake sudo-rs shim (env wipe + `--preserve-env` ignored) reproduces the exact `DEBUG: unbound variable` failure with the old invocation. With `sudo-keep-env`, `DEBUG`, multi-line values, `PATH`, and non-identifier names (`FOO-BAR=...`) all come through. - Local: same check against real classic sudo. - shellcheck not run locally (unavailable in sandbox); relying on pre-commit CI. - **Not yet verified on an actual ubuntu-26.04 runner.** Other sudo-rs differences could show up further along, e.g. `sudo -lU` or copying the runner's `/etc/sudoers.d` entry in `set-username-and-hostname`. Keeping this as a draft until a 26.04 run gets through setup. <!-- junior-request-attribution:start --> via **scott.strong**. <!-- junior-request-attribution:end --> <!-- junior-session-footer:start --> <!-- junior-conversation-id:slack%3AGFHH72H63%3A1792530202.183289 --> -- [View Junior Session](https://junior-prod.sentry.dev/conversations/slack%3AGFHH72H63%3A1792530202.183289) [[Sentry]](https://sentry.sentry.io/explore/conversations/slack%3AGFHH72H63%3A1792530202.183289/?project=4510944073809921) <!-- junior-session-footer:end --> Co-authored-by: sentry-junior[bot] <264270552+sentry-junior[bot]@users.noreply.github.com> Co-authored-by: Michael Warkentin <michael@sentry.io>
mwarkentin
approved these changes
Oct 20, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Promotes
maintostableso consumers that check out TACOS scripts fromrefs/heads/stable(e.g.getsentry/ops) pick up the sudo-rs fix.mainis 1 commit ahead ofstable:sudo --preserve-env(broken on ubuntu-26.04 / sudo-rs) (fix(ci): don't rely onsudo --preserve-env(broken on ubuntu-26.04 / sudo-rs) #332)GitHub's
ubuntu-26.04runners ship sudo-rs, which ignores a bare--preserve-env, so every TACOS step lost its environment after the user switch (DEBUG: unbound variable). #332 addslib/ci/bin/sudo-keep-envand uses it indefault-shell,sudo-ssh-agent, andsudo-ssh-add.Files:
lib/ci/bin/sudo-keep-env,lib/ci/bin/sudo-ssh-add,lib/ci/bin/sudo-ssh-agent,lib/ci/default-shell.via michael.
--
View Junior Session [Sentry]