fix(wsl): ssh-probe guard + harden Linux integration test auth#247
Merged
Conversation
The SSH-first probe added in the envy-nx backport calls bare `ssh -T git@github.com` from the begin block. With ErrorActionPreference=Stop that throws on Windows PowerShell hosts where OpenSSH isn't on PATH, aborting wsl_setup.ps1 partway through pwsh provisioning. Guard the probe with Get-Command so we silently fall back to HTTPS - matching the pre-backport behavior on Windows while keeping SSH-preference on Linux/macOS. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
szymonos
added
the
test:integration
szymonos
changed the title
szymonos
removed
the
test:integration
The Linux integration test routinely fails on shared CI runner IPs with
"API rate limit exceeded" during oh-my-posh release lookup. Cause: the
get_gh_release_latest helper in source.sh hits api.github.com without a
token (it only consulted gh auth, which is empty in the container since
linux_setup.sh runs with --skip_gh_auth true). The unauthenticated 60/hr
per-IP quota on shared GitHub Actions runners is regularly exhausted.
Three coordinated changes:
1. .assets/docker/Dockerfile: accept ARG GITHUB_TOKEN, propagate it
inline into the su -c invocation (su -c clears env, so prefix-style
`GITHUB_TOKEN='...' linux_setup.sh ...` is the cleanest path).
2. .github/workflows/test_linux.yml: pass build-args
GITHUB_TOKEN=${{ secrets.GITHUB_TOKEN }} to docker/build-push-action.
3. .assets/provision/source.sh:
- get_gh_release_latest: fall back from `gh auth token` to
${GITHUB_TOKEN:-} so containerized runs without gh-auth still
authenticate.
- install_github_release_user: broaden the prefix regex from
`^gh[po]_` to `^(gh[a-z]_|github_pat_)` so it accepts the ghs_
server-to-server token GitHub Actions auto-provides (the previous
regex only matched ghp_/gho_ personal/OAuth tokens).
Local Docker builds without --build-arg GITHUB_TOKEN remain functional
(the var stays empty; behavior matches pre-fix). Token does not leak
beyond the runner since the test image uses push: false.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
szymonos
changed the title
szymonos
added
the
test:integration
This was referenced May 2, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Two coordinated fixes on this branch:
1. Bug fix:
Invoke-GhRepoClonessh-probe guard for Windows hosts (dfb5943)The SSH-first probe added in #246 calls bare
ssh -T git@github.comfromInvoke-GhRepoClone's begin block. With$ErrorActionPreference = 'Stop'and Windows PowerShell hosts where OpenSSH isn't on PATH, that throws and abortswsl_setup.ps1mid-pwshprovisioning at line 618 (Invoke-GhRepoClone -OrgRepo 'szymonos/ps-modules').Fix: wrap the probe in
Get-Command ssh -ErrorAction SilentlyContinueso the function silently falls back to HTTPS on hosts without ssh - matching pre-#246 behavior on Windows while keeping SSH preference on Linux/macOS hosts (where envy-nx normally runs and where this code path was originally validated).2. CI infra: harden Linux integration test against api.github.com rate limit (
97ddcdc)The first attempt at this PR's integration test failed with "API rate limit exceeded" during oh-my-posh release lookup (log). This is a pre-existing flake unrelated to the WSL fix - the Docker build calls
api.github.comunauthenticated, and shared GitHub Actions runner IPs routinely exhaust the 60/hr public quota.Three coordinated changes:
.assets/docker/Dockerfile: acceptARG GITHUB_TOKEN, propagate inline into thesu -cinvocation (su -cclears env, so prefix-style env-var injection is the cleanest path)..github/workflows/test_linux.yml: passbuild-args: GITHUB_TOKEN=${{ secrets.GITHUB_TOKEN }}to the build-push step..assets/provision/source.sh:get_gh_release_latest: fall back fromgh auth tokento${GITHUB_TOKEN:-}so containerized runs withoutghauth still authenticate.install_github_release_user: broaden the prefix regex from^gh[po]_to^(gh[a-z]_|github_pat_)so it accepts theghs_server-to-server token Actions auto-provides (the previous regex only matchedghp_/gho_).Local Docker builds without
--build-arg GITHUB_TOKENremain functional (var stays empty, behavior matches pre-fix). The token does not leak beyond the runner since the test image usespush: false.Test plan
pwshparse-check onmodules/InstallUtils/Functions/git.ps1make lintcleanmake test- 22 bats / 42 Pester, all greensu -carg expands$GITHUB_TOKENfrom the build-arg while preserving deferred$HOMEexpansiontest:integrationre-attached)wsl_setup.ps1flow on a Windows host without OpenSSH installed - theInvoke-GhRepoClone -OrgRepo 'szymonos/ps-modules'call should now succeed via HTTPS🤖 Generated with Claude Code