From fd596cf18820721f9e907d4d662b0dea6df6cf34 Mon Sep 17 00:00:00 2001
From: Kevin Veen-Birkenbach <kevin@veen.world>
Date: Mon, 19 Oct 2026 22:36:32 +0200
Subject: [PATCH] fix(ci): tear down host AppArmor profiles on GitHub runners
 like on dev hosts

ubuntu-26.04 runner images load per-binary AppArmor profiles (wg-quick,
dig, who, fusermount3, ~150 upstream). Path-based attachment applies to
every unconfined task, so the profiles also attach inside our privileged
`apparmor=unconfined` containers. The upstream wg-quick profile only allows
`/usr/bin/ip`; on CentOS and Fedora nodes `ip` lives at `/usr/sbin/ip`, so
`svc-net-wireguard : Bring 'data' up` failed with rc=126:

    /usr/bin/wg-quick: line 32: /usr/sbin/ip: Permission denied
    apparmor="DENIED" operation="exec" profile="wg-quick" name="/usr/sbin/ip"

(run 39268090162, Fediwall#0, CentOS swarm VPN).

Dev hosts never see this: `environment-bootstrap` runs
`security-apparmor-teardown`. The runners skipped that preparation. The
deploy, workspace and DNS workflows now run the same target on the runner
host before any container starts (skipped under act, whose job container
cannot reach the host's policy), so CI matches the dev-host state for all
profiles, not only the ones seen so far.

A dedicated permissive profile for the containers was rejected: every
AppArmor host without that profile loaded would refuse to start them,
including dev hosts and act.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 .github/workflows/call-test-deploy.yml    | 5 +++++
 .github/workflows/call-test-dns.yml       | 5 +++++
 .github/workflows/call-test-workspace.yml | 5 +++++
 3 files changed, 15 insertions(+)

diff --git a/.github/workflows/call-test-deploy.yml b/.github/workflows/call-test-deploy.yml
index ca454e0e46..dc3e52ad1b 100644
--- a/.github/workflows/call-test-deploy.yml
+++ b/.github/workflows/call-test-deploy.yml
@@ -308,6 +308,11 @@ jobs:
         shell: bash
         run: ./scripts/github/runner/relocate_docker_dataroot.sh
 
+      - name: 🛡️ Tear down host AppArmor profiles (dev-host parity)
+        if: ${{ !env.ACT }}
+        shell: bash
+        run: make security-apparmor-teardown
+
       - name: 🔍 Resolve repository owner
         shell: bash
         run: |
diff --git a/.github/workflows/call-test-dns.yml b/.github/workflows/call-test-dns.yml
index d993811a4b..05c4c9ed3b 100644
--- a/.github/workflows/call-test-dns.yml
+++ b/.github/workflows/call-test-dns.yml
@@ -41,6 +41,11 @@ jobs:
       - name: ⬇️ Checkout
         uses: actions/checkout@v7.0.0
 
+      - name: 🛡️ Tear down host AppArmor profiles (dev-host parity)
+        if: ${{ !env.ACT }}
+        shell: bash
+        run: make security-apparmor-teardown
+
       - name: 🔑 Login to GHCR
         uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
         with:
diff --git a/.github/workflows/call-test-workspace.yml b/.github/workflows/call-test-workspace.yml
index 4c748b56e4..a888feb280 100644
--- a/.github/workflows/call-test-workspace.yml
+++ b/.github/workflows/call-test-workspace.yml
@@ -88,6 +88,11 @@ jobs:
       - name: ⬇️ Checkout repository
         uses: actions/checkout@v7.0.0
 
+      - name: 🛡️ Tear down host AppArmor profiles (dev-host parity)
+        if: ${{ !env.ACT }}
+        shell: bash
+        run: make security-apparmor-teardown
+
       - name: "📥 Load the rescue paths into job env"
         shell: bash
         run: |