fix: detect ubuntu-slim runners early and bail out

[devantler]

Summary

Detect ubuntu-slim runners (Hosted Compute Agent Docker containers) early and bail out with an informative message, instead of crashing with chown: invalid user: 'undefined'.

Problem

ubuntu-slim runners are GitHub-hosted Linux containers that lack the standard USER environment variable (runner). When harden-runner runs on these runners, chownForFolder(process.env.USER, ...) executes sudo chown -R undefined /home/agent, which crashes the step.

The existing isDocker() check does not catch ubuntu-slim because the is-docker npm package looks for /.dockerenv, which Hosted Compute Agent containers do not have.

Fix

Add an early bail-out check in both setup.ts and cleanup.ts:

  console.log(common.UBUNTU_SLIM_MESSAGE);
  return;
}

This follows the existing patterns for isDocker(), isARCRunner(), and other unsupported runner type detection.

Detection rationale

• Standard GitHub-hosted Ubuntu VMs always set USER=runner
• ubuntu-slim (Hosted Compute Agent Docker containers) do not set USER
• Combined with isGithubHosted() and process.platform === "linux", this reliably identifies ubuntu-slim

Files changed

File	Change
src/common.ts	Add UBUNTU_SLIM_MESSAGE constant
src/setup.ts	Add early bail-out after isDocker() check
src/cleanup.ts	Add early bail-out after isDocker() check

Fixes #627

[varunsh-coder]

Thanks for the pr @devantler !
Will review soon