From b2a9af3a106f89969d665d5adbe5d8823c50fe62 Mon Sep 17 00:00:00 2001 From: prql-bot <107324867+prql-bot@users.noreply.github.com> Date: Sat, 29 Aug 2026 08:04:04 +0000 Subject: [PATCH 1/2] ci: install cargo-insta and cargo-nextest into the tend sandbox MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `.github/actions/tend-setup` installs both under the runner user's home, which tend keeps off the sandbox PATH; the agent gets a stub that exits 127. Reinstall them under the sandbox user's home with `sandbox_setup:`, which is the remedy that stub names. Both ship prebuilt binaries, so the pair downloads in ~1.2s. Verified from inside a tend session: from the blocked-stub state the block resolves both tools, and `task prqlc:test` then runs to completion — 704 tests passed, no snapshots to review, exit 0. --- .config/tend.yaml | 21 +++++++++++++++++++++ .github/workflows/tend-ci-fix.yaml | 6 ++++++ .github/workflows/tend-mention.yaml | 6 ++++++ .github/workflows/tend-nightly.yaml | 6 ++++++ .github/workflows/tend-notifications.yaml | 6 ++++++ .github/workflows/tend-review-runs.yaml | 6 ++++++ .github/workflows/tend-review.yaml | 6 ++++++ .github/workflows/tend-triage.yaml | 6 ++++++ .github/workflows/tend-weekly.yaml | 6 ++++++ 9 files changed, 69 insertions(+) diff --git a/.config/tend.yaml b/.config/tend.yaml index 69751644747d..d01a4fb840ad 100644 --- a/.config/tend.yaml +++ b/.config/tend.yaml @@ -10,6 +10,27 @@ secrets: - DOCKERHUB_USERNAME setup: - uses: ./.github/actions/tend-setup +# `setup:` installs cargo-insta and cargo-nextest under the *runner* user's +# home, which tend deliberately keeps off the sandbox PATH — the agent gets a +# stub that exits 127. Reinstall them under the sandbox user's home, which is +# what that stub asks for. Both ship prebuilt binaries, so this downloads rather +# than builds (~1s for the pair). +# +# `~/.local/bin` rather than the cargo default: the sandbox PATH puts +# `~/.tend-blocked/bin` ahead of `~/.cargo/bin`, so an install at the default +# location would still be shadowed by the stub. Hence `CARGO_HOME` on the +# cargo-dist installer, which places the binary at `$CARGO_HOME/bin`. +# +# Without this, `task prqlc:test` and `task prqlc:pull-request` — the inner loop +# and pre-return gate `CLAUDE.md` documents — abort in every tend session. +sandbox_setup: + - mkdir -p ~/.local/bin + - curl -LsSf https://get.nexte.st/latest/linux | tar zxf - -C ~/.local/bin + - cargo-nextest --version + - curl -LsSf + https://github.com/mitsuhiko/insta/releases/latest/download/cargo-insta-installer.sh + | CARGO_HOME=~/.local sh + - cargo-insta --version workflows: ci-fix: watched_workflows: diff --git a/.github/workflows/tend-ci-fix.yaml b/.github/workflows/tend-ci-fix.yaml index 7f9e059049f6..2f1352a63107 100644 --- a/.github/workflows/tend-ci-fix.yaml +++ b/.github/workflows/tend-ci-fix.yaml @@ -41,6 +41,12 @@ jobs: anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }} bot_name: prql-bot model: opus + sandbox_setup: | + mkdir -p ~/.local/bin + curl -LsSf https://get.nexte.st/latest/linux | tar zxf - -C ~/.local/bin + cargo-nextest --version + curl -LsSf https://github.com/mitsuhiko/insta/releases/latest/download/cargo-insta-installer.sh | CARGO_HOME=~/.local sh + cargo-insta --version prompt: | /tend-ci-runner:ci-fix ${{ github.event.workflow_run.id }} - Run URL: ${{ github.event.workflow_run.html_url }} diff --git a/.github/workflows/tend-mention.yaml b/.github/workflows/tend-mention.yaml index fdb0c4174de2..cd56d81ab7e0 100644 --- a/.github/workflows/tend-mention.yaml +++ b/.github/workflows/tend-mention.yaml @@ -427,6 +427,12 @@ jobs: anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }} bot_name: prql-bot model: opus + sandbox_setup: | + mkdir -p ~/.local/bin + curl -LsSf https://get.nexte.st/latest/linux | tar zxf - -C ~/.local/bin + cargo-nextest --version + curl -LsSf https://github.com/mitsuhiko/insta/releases/latest/download/cargo-insta-installer.sh | CARGO_HOME=~/.local sh + cargo-insta --version prompt: >- ${{ steps.delay.outputs.seconds && format('This job started {0}s after the triggering event (over ~40s means it was queued). ', diff --git a/.github/workflows/tend-nightly.yaml b/.github/workflows/tend-nightly.yaml index 14ff2dfd0a57..7d79a31ba7ed 100644 --- a/.github/workflows/tend-nightly.yaml +++ b/.github/workflows/tend-nightly.yaml @@ -41,5 +41,11 @@ jobs: anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }} bot_name: prql-bot model: opus + sandbox_setup: | + mkdir -p ~/.local/bin + curl -LsSf https://get.nexte.st/latest/linux | tar zxf - -C ~/.local/bin + cargo-nextest --version + curl -LsSf https://github.com/mitsuhiko/insta/releases/latest/download/cargo-insta-installer.sh | CARGO_HOME=~/.local sh + cargo-insta --version prompt: | /tend-ci-runner:nightly diff --git a/.github/workflows/tend-notifications.yaml b/.github/workflows/tend-notifications.yaml index ee342a6d8ff8..56cff920ce09 100644 --- a/.github/workflows/tend-notifications.yaml +++ b/.github/workflows/tend-notifications.yaml @@ -156,5 +156,11 @@ jobs: anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }} bot_name: prql-bot model: opus + sandbox_setup: | + mkdir -p ~/.local/bin + curl -LsSf https://get.nexte.st/latest/linux | tar zxf - -C ~/.local/bin + cargo-nextest --version + curl -LsSf https://github.com/mitsuhiko/insta/releases/latest/download/cargo-insta-installer.sh | CARGO_HOME=~/.local sh + cargo-insta --version prompt: | /tend-ci-runner:notifications diff --git a/.github/workflows/tend-review-runs.yaml b/.github/workflows/tend-review-runs.yaml index 4a41b655c438..945ef010658d 100644 --- a/.github/workflows/tend-review-runs.yaml +++ b/.github/workflows/tend-review-runs.yaml @@ -41,5 +41,11 @@ jobs: anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }} bot_name: prql-bot model: opus + sandbox_setup: | + mkdir -p ~/.local/bin + curl -LsSf https://get.nexte.st/latest/linux | tar zxf - -C ~/.local/bin + cargo-nextest --version + curl -LsSf https://github.com/mitsuhiko/insta/releases/latest/download/cargo-insta-installer.sh | CARGO_HOME=~/.local sh + cargo-insta --version prompt: | /tend-ci-runner:review-runs diff --git a/.github/workflows/tend-review.yaml b/.github/workflows/tend-review.yaml index 2c63eaf6da1a..234df2c27bc4 100644 --- a/.github/workflows/tend-review.yaml +++ b/.github/workflows/tend-review.yaml @@ -156,6 +156,12 @@ jobs: anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }} bot_name: prql-bot model: opus + sandbox_setup: | + mkdir -p ~/.local/bin + curl -LsSf https://get.nexte.st/latest/linux | tar zxf - -C ~/.local/bin + cargo-nextest --version + curl -LsSf https://github.com/mitsuhiko/insta/releases/latest/download/cargo-insta-installer.sh | CARGO_HOME=~/.local sh + cargo-insta --version prompt: >- ${{ format('/tend-ci-runner:review {0}', github.event.pull_request.number) }} diff --git a/.github/workflows/tend-triage.yaml b/.github/workflows/tend-triage.yaml index 13fbb7714dc4..cf93fc5a95b1 100644 --- a/.github/workflows/tend-triage.yaml +++ b/.github/workflows/tend-triage.yaml @@ -53,6 +53,12 @@ jobs: anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }} bot_name: prql-bot model: opus + sandbox_setup: | + mkdir -p ~/.local/bin + curl -LsSf https://get.nexte.st/latest/linux | tar zxf - -C ~/.local/bin + cargo-nextest --version + curl -LsSf https://github.com/mitsuhiko/insta/releases/latest/download/cargo-insta-installer.sh | CARGO_HOME=~/.local sh + cargo-insta --version prompt: | /tend-ci-runner:triage ${{ github.event.issue.number }} diff --git a/.github/workflows/tend-weekly.yaml b/.github/workflows/tend-weekly.yaml index 504537ec0fe4..c4fa08d78408 100644 --- a/.github/workflows/tend-weekly.yaml +++ b/.github/workflows/tend-weekly.yaml @@ -41,5 +41,11 @@ jobs: anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }} bot_name: prql-bot model: opus + sandbox_setup: | + mkdir -p ~/.local/bin + curl -LsSf https://get.nexte.st/latest/linux | tar zxf - -C ~/.local/bin + cargo-nextest --version + curl -LsSf https://github.com/mitsuhiko/insta/releases/latest/download/cargo-insta-installer.sh | CARGO_HOME=~/.local sh + cargo-insta --version prompt: | /tend-ci-runner:weekly From 0369e91dd617fc1ee3891175dd6cb0e38464a021 Mon Sep 17 00:00:00 2001 From: prql-bot <107324867+prql-bot@users.noreply.github.com> Date: Sat, 29 Aug 2026 08:16:42 +0000 Subject: [PATCH 2/2] ci: drop the now-unused runner-home installs, narrow the config comment MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Addresses self-review on #6251. `tend-setup` installed cargo-insta and cargo-nextest with `cargo-install` into the runner user's home. That action is used only by the eight tend workflows, and no runner-side step in any of them invokes `cargo` or `task` — the agent is the only consumer, and the runner home is exactly what the sandbox PATH excludes by design. Now that `sandbox_setup:` installs both under the sandbox home, those two steps install into a location nothing reads, and build both crates from source on a cache miss in every tend job. Also narrows the config comment: `task prqlc:pull-request` reaches `cargo llvm-cov` (via `prqlc:test-all`) and `pre-commit` (via `:lint`), neither of which is on the sandbox PATH at all, so this change does not restore that gate — only `task prqlc:test`. --- .config/tend.yaml | 26 +++++++++++++++----------- .github/actions/tend-setup/action.yaml | 8 -------- 2 files changed, 15 insertions(+), 19 deletions(-) diff --git a/.config/tend.yaml b/.config/tend.yaml index d01a4fb840ad..9b1d8a978353 100644 --- a/.config/tend.yaml +++ b/.config/tend.yaml @@ -10,19 +10,23 @@ secrets: - DOCKERHUB_USERNAME setup: - uses: ./.github/actions/tend-setup -# `setup:` installs cargo-insta and cargo-nextest under the *runner* user's -# home, which tend deliberately keeps off the sandbox PATH — the agent gets a -# stub that exits 127. Reinstall them under the sandbox user's home, which is -# what that stub asks for. Both ship prebuilt binaries, so this downloads rather -# than builds (~1s for the pair). +# cargo-insta and cargo-nextest are used only by the agent, never by a +# runner-side step. `tend-setup` used to install them with `cargo-install`, +# under the *runner* user's home — which tend deliberately keeps off the sandbox +# PATH, since that home can hold credentials — so the agent got a stub that +# exits 127. Install them under the sandbox user's home instead, which is what +# that stub asks for. Both ship prebuilt binaries, so this downloads rather than +# builds (~1s for the pair). # -# `~/.local/bin` rather than the cargo default: the sandbox PATH puts -# `~/.tend-blocked/bin` ahead of `~/.cargo/bin`, so an install at the default -# location would still be shadowed by the stub. Hence `CARGO_HOME` on the -# cargo-dist installer, which places the binary at `$CARGO_HOME/bin`. +# `~/.local/bin` rather than the cargo default: it is first on the sandbox PATH, +# ahead of both `~/.tend-blocked/bin` (where the 127 stubs live) and +# `~/.cargo/bin`. Hence `CARGO_HOME` on the cargo-dist installer, which places +# the binary at `$CARGO_HOME/bin`. # -# Without this, `task prqlc:test` and `task prqlc:pull-request` — the inner loop -# and pre-return gate `CLAUDE.md` documents — abort in every tend session. +# Without this, `task prqlc:test` — the inner loop `CLAUDE.md` documents — +# aborts in every tend session. `task prqlc:pull-request` needs more: it also +# reaches `cargo llvm-cov` and `pre-commit`, neither of which is on the sandbox +# PATH at all. sandbox_setup: - mkdir -p ~/.local/bin - curl -LsSf https://get.nexte.st/latest/linux | tar zxf - -C ~/.local/bin diff --git a/.github/actions/tend-setup/action.yaml b/.github/actions/tend-setup/action.yaml index 0b69a0b30b17..ad9d1d52f919 100644 --- a/.github/actions/tend-setup/action.yaml +++ b/.github/actions/tend-setup/action.yaml @@ -17,14 +17,6 @@ runs: repo-token: ${{ inputs.github-token }} version: 3.53.1 - - uses: baptiste0928/cargo-install@v3 - with: - crate: cargo-insta - - - uses: baptiste0928/cargo-install@v3 - with: - crate: cargo-nextest - - run: ./.github/workflows/scripts/set_version.sh shell: bash