0 Fork 0

mirror of https://github.com/kevinveenbirkenbach/computer-playbook.git synced 2026-11-06 02:54:26 +00:00

Files

T

kevinveenbirkenbachandClaude Opus 5.5 a63cbcb1f7 fix(apparmor): leave a read-only /proc/sys alone in teardown and restore

Fork run 41911075483 (feature/store-i18n 2fd6c6d310) lost both workspace
jobs, debian:13 and ubuntu:26.04, in make security-apparmor-teardown:

  common.sh: line 75: /proc/sys/kernel/apparmor_restrict_unprivileged_unconfined: Read-only file system

Inside the workspace container /proc/sys is mounted read-only, and the
write that #1371 added ran under set -e. A sysctl that cannot be written
now leaves the restriction as it is with a log line instead of failing
the teardown, and only a successful write records the previous value.
Restore keeps its record when it cannot write the sysctl back.

The tests call the helpers under set -euo pipefail like teardown.sh and
use /proc/sys/kernel/ostype as a sysctl nobody can write; both new tests
fail against the previous common.sh.

| 🎯 Fix | 💥 Break | 🌱 Efficiency | ⚡ Speed | 🛡️ Security | 🏆 Score | Gate |
| --- | --- | --- | --- | --- | --- | --- |
| 95 % | 3 % | – | – | ~100 % | 92 | ✅ 90/5, efficiency and speed <= 100, security 100 % |

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-11-04 23:25:38 +01:00

container

style: apply the project formatters

2026-08-18 03:22:05 +02:00

docker

fix(cache): stop validating content types on the raw package proxies

2026-10-22 00:05:43 +02:00

git

fix(ci): check the PR head against the main it was tested with

2026-10-29 22:10:45 +01:00

github

fix(ci): put containerd, Docker and swap on the runner's empty spare disk

2026-11-01 12:31:02 +01:00

image

perf(ci): fold the matrix job into the image job and stream its output

2026-09-16 21:48:12 +02:00

install

fix(install): stage the package build workspace with tar, not rsync

2026-11-04 17:35:08 +01:00

inventory

style: delete every comment the comments-valid policy rejects

2026-08-18 03:22:02 +02:00

lint

fix(lint): make mbake format the Makefile the same on every machine

2026-10-29 12:29:08 +01:00

make

fix(make): stop a repeated lint target from hiding its own failure

2026-09-19 07:41:01 +02:00

README.md

Script Collection

This directory contains automation scripts used across the project.

system/ contains host and system-facing helpers.
container/ contains helpers that run inside the local container.
github/ contains GitHub workflow helper scripts.
For the canonical Make target index, see make.md.
🛠️ Organize operational helpers for development, CI, release, and maintenance
🧭 Separate responsibilities into focused subdirectories with clear scope
📚 Keep script-based workflows discoverable and easier to navigate

The scope of this folder is script organization at the repository level. Detailed responsibilities belong in the README files of the respective subdirectories.