From 1b17eb295a925789822f071d3757eb6690fdc7f2 Mon Sep 17 00:00:00 2001 From: Sahilb315 Date: Tue, 14 Jul 2026 01:14:10 +0530 Subject: [PATCH] ci: normalize /usr/local/bin perms before system-install e2e MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The GitHub ubuntu-latest runner ships /usr/local/bin world-writable so tooling can install without sudo. System install correctly refuses a world-writable dir for the shared binary (any local user could replace it and hijack every user's npm/pip). No FHS-compliant distro or Docker image ships it world-writable — it is always root:root 0755 or root:staff 2775 — so this normalizes only the anomalous CI runner back to standard perms and still exercises the real /usr/local/bin path. --- .github/workflows/pmg-e2e.yml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/.github/workflows/pmg-e2e.yml b/.github/workflows/pmg-e2e.yml index c32fad7..62bd5c4 100644 --- a/.github/workflows/pmg-e2e.yml +++ b/.github/workflows/pmg-e2e.yml @@ -929,6 +929,12 @@ jobs: - name: Install PMG system-wide run: | + # GitHub runners ship /usr/local/bin world-writable; system install + # (correctly) requires a root-owned, non-world-writable dir for the + # shared binary. Normalize to the standard production perms first. + ls -ld /usr/local/bin + sudo chown root:root /usr/local/bin + sudo chmod 755 /usr/local/bin sudo install -m 755 bin/pmg /usr/local/bin/pmg sudo pmg setup install --system