Fix randomly failing build.sh test

[edolstra]

Motivation

Fix random failures in build.sh in GHA, e.g. https://github.com/DeterminateSystems/nix-src/actions/runs/30926645783/job/92052907077.

Context

Summary by CodeRabbit

• Tests
  • Improved functional test reliability in environments where sandboxing or unprivileged user namespaces are unavailable.
  • Tests now skip gracefully when required system capabilities are not supported.
  • Updated build and flake-check scenarios to avoid unintended sandbox fallbacks.

[github-actions]

🚀 Deployed on https://6a732c477b946e50eef96d7e--determinate-nix.netlify.app

[coderabbitai]

📝 Walkthrough

Walkthrough

The changes centralize unprivileged user namespace detection and update cancelled-builds functional tests to run only with supported namespaces and without sandbox fallback.

Changes

Cancelled-builds functional tests

Layer / File(s)	Summary
Centralize namespace capability detection tests/functional/common/functions.sh	Adds unprivilegedUserNamespacesSupported() and uses it from requiresUnprivilegedUserNamespaces().
Require sandboxing for cancellation checks tests/functional/build.sh	Adds the namespace capability guard and passes --no-sandbox-fallback to the nix flake check and nix build commands.

Estimated code review effort: 1 (Trivial) | ~4 minutes

Suggested reviewers: xokdvium

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the randomly failing build.sh test addressed by the changes.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch require-sandbox

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

🧹 Nitpick comments (1)

tests/functional/build.sh (1)

221-221: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Label the namespace-limit diagnostics.

cat writes two bare values to stderr. If one /proc file is unavailable, the output does not identify which value belongs to max_user_namespaces or max_pid_namespaces. Print each limit name with its value.

Proposed diagnostic format

-    cat /proc/sys/user/max_user_namespaces /proc/sys/user/max_pid_namespaces >&2 || true
+    for limit in max_user_namespaces max_pid_namespaces; do
+        printf '%s=' "$limit" >&2
+        cat "/proc/sys/user/$limit" >&2 || printf '<unavailable>' >&2
+        printf '\n' >&2
+    done

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@tests/functional/build.sh` at line 221, Update the namespace-limit diagnostic
near the existing /proc reads to print each limit’s name together with its
value, while retaining the best-effort behavior when either file is unavailable.
Ensure max_user_namespaces and max_pid_namespaces remain distinguishable in
stderr output.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@tests/functional/build.sh`:
- Line 221: Update the namespace-limit diagnostic near the existing /proc reads
to print each limit’s name together with its value, while retaining the
best-effort behavior when either file is unavailable. Ensure max_user_namespaces
and max_pid_namespaces remain distinguishable in stderr output.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 88c4f79f-bb12-46d2-8594-443ed732a312

📥 Commits

Reviewing files that changed from the base of the PR and between e8f0c5f and e196a67.

📒 Files selected for processing (1)

• tests/functional/build.sh

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/libutil/linux/linux-namespaces.cc`:
- Around line 76-81: Update the namespace probe error handling around
startProcess(), pid.wait(), and the child status checks to distinguish status 1
mount-namespace failures from status 2 /proc remount PID-namespace failures.
Ensure SysError messages are not always labeled as mount namespace failures;
report the specific failed operation when known, or use a neutral “namespace
probe failed” message.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 19977531-95e0-4e7a-9a61-e412179e533d

📥 Commits

Reviewing files that changed from the base of the PR and between e196a67 and 75616d6.

📒 Files selected for processing (2)

• src/libutil/linux/linux-namespaces.cc
• tests/functional/build.sh

🚧 Files skipped from review as they are similar to previous changes (1)

• tests/functional/build.sh

[coderabbitai]

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.