From 80c3d7b010df921f45a727a09a5a54d35e16f110 Mon Sep 17 00:00:00 2001 From: hordunlarmy Date: Thu, 29 Jan 2026 20:27:10 +0100 Subject: [PATCH] fix(connection): Wrap sudo commands in bash -c to prevent partial execution --- changelogs/2026-01-29_20-18-38.md | 2 +- changelogs/2026-01-29_20-26-44.md | 6 + coverage.xml | 1185 +++++++++++++++-------------- src/connection.py | 4 +- tests/unit/test_connection.py | 3 +- 5 files changed, 608 insertions(+), 592 deletions(-) create mode 100644 changelogs/2026-01-29_20-26-44.md diff --git a/changelogs/2026-01-29_20-18-38.md b/changelogs/2026-01-29_20-18-38.md index 75c81a6..571ee3a 100644 --- a/changelogs/2026-01-29_20-18-38.md +++ b/changelogs/2026-01-29_20-18-38.md @@ -7,4 +7,4 @@ - **Internal Refactoring**: An internal variable (`env_blob_key` to `comp_env_key`) within the environment variable merging logic was renamed for improved clarity and maintainability. This change does not alter user-facing behavior. ### Removed -- Explicit environment variable mappings for action inputs from `action.yml`. This removal is a direct consequence of the improved configuration input handling, as inputs are now read directly by the action's script. \ No newline at end of file +- Explicit environment variable mappings for action inputs from `action.yml`. This removal is a direct consequence of the improved configuration input handling, as inputs are now read directly by the action's script. diff --git a/changelogs/2026-01-29_20-26-44.md b/changelogs/2026-01-29_20-26-44.md new file mode 100644 index 0000000..ae2518e --- /dev/null +++ b/changelogs/2026-01-29_20-26-44.md @@ -0,0 +1,6 @@ +# Changelog + +## [Unreleased] + +### Changed +- Improved the execution of `sudo` commands for remote connections. Commands are now wrapped in `bash -c` to ensure `sudo` correctly applies to the entire command, including pipelines and chained commands, preventing partial execution failures. \ No newline at end of file diff --git a/coverage.xml b/coverage.xml index a5d880a..8781109 100644 --- a/coverage.xml +++ b/coverage.xml @@ -1,12 +1,12 @@ - + /workspace/personal/MetalDeploy/src - + @@ -14,7 +14,7 @@ - + @@ -27,63 +27,69 @@ - - - - - - - - + + + + + + + - - + + - + - - - + + + + - - - - - + + + - + + + + + - + + - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + - + @@ -91,76 +97,79 @@ - - - - - + + + + + - - - - - - + + + + + + - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + - + @@ -172,289 +181,287 @@ - - - - - - - + + + + + + + - - - - - - - + + + + + + + - - - - - + + + + + - - - - - - - + + + + + + + - - - - - + + + + + - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + - - - - - - - - - - - - - + + + + + + + + + + + + + - - - - - - - - + + + + + + + + - + - - - - - - - - - - - - - - + + + + + + + + + + + + + + - - - - - - - - - - + + + + + + + + + + - - - - - + + + + + - + - - - - - - - - - - - + + + + + + + + + + + - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + - - - + + + - - - - - - + + + + + + - - - - - - - + + + + + + + - - - - - - - - - - - + + + + + + + + + + + - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + - - - - - - - - - - - - + + + + + + + + + + + + - + - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + - + - - - - - - - + + + + - - - - - - + + + + + - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + - + - + + - + @@ -464,58 +471,58 @@ - - + + - - - - - + + + + + - - - + + + - - - - - - - - - - - + + + + + + + + + + + - - + + - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + @@ -525,11 +532,11 @@ - - - - - + + + + + @@ -537,18 +544,18 @@ - - - - - - - - - + + + + + + + + + - + @@ -564,96 +571,96 @@ - - - - - - + + + + + + - - - - - - - - + + + + + + + + - - - - - - + + + + + + - - - - - - - - - + + + + + + + + + - + - - - - - - - - - - + + + + + + + + + + - - - + + + - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -661,73 +668,73 @@ - + - + - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + - + - + - + - - - - - - - - + + + + + + + + - + - + @@ -746,17 +753,17 @@ - - - - - + + + + + - + - + @@ -791,67 +798,67 @@ - - + + - - - - - - + + + + + + - - - - - - + + + + + + - - - + + + - - - - - - - + + + + + + + - + - + - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + @@ -860,50 +867,50 @@ - + - - - - - - + + + + + + - - - - + + + + - + - - - - - - - + + + + + + + - - - - - - - + + + + + + + - - - + + + - - - + + + diff --git a/src/connection.py b/src/connection.py index f428d45..cac0ba2 100644 --- a/src/connection.py +++ b/src/connection.py @@ -32,7 +32,9 @@ def run_command(conn, command: str, force_sudo: bool = False, use_shell_profile: if not use_shell_profile: # Just sudo without the expensive profile loading - return conn.run(f"sudo {command}", warn=False) + # Wrap in bash -c to ensure sudo applies to the entire pipeline/batch + escaped_command = command.replace("'", "'\"'\"'") + return conn.run(f"sudo bash -c '{escaped_command}'", warn=False) if config.REMOTE_USER == "root": home_dir = "/root" diff --git a/tests/unit/test_connection.py b/tests/unit/test_connection.py index 16d3c8a..2925582 100644 --- a/tests/unit/test_connection.py +++ b/tests/unit/test_connection.py @@ -53,7 +53,8 @@ def test_run_command_no_profile(mock_conn, monkeypatch): run_command(mock_conn, "simple-cmd", use_shell_profile=False) call_args = mock_conn.run.call_args[0][0] - assert call_args == "sudo simple-cmd" + assert "sudo bash -c" in call_args + assert "'simple-cmd'" in call_args assert "bash -l -c" not in call_args