fix(ci): run clone-manifest shell tests with bash, not dash #3202

Merged

devops-engineer merged 1 commits from fix/ops-scripts-shelltests-bash-not-dash into main 2026-06-24 02:14:51 +00:00

Conversation 2 Commits 1 Files Changed 3

+11 -4

devops-engineer commented 2026-06-24 02:09:18 +00:00

Member

Copy Link

Copy Source

Problem

The two clone-manifest shell-test steps I wired into test-ops-scripts.yml (in #3193 + #3187) have been failing on main, keeping the Ops Scripts Tests lane red.

Root cause — sh-vs-dash: the CI runner's /bin/sh is dash, and the test harnesses invoked clone-manifest.sh via sh. clone-manifest.sh uses set -o pipefail, which dash rejects:

scripts/clone-manifest.sh: 31: set: Illegal option -o pipefail

So the script died immediately and the tests failed. It passed locally only because macOS /bin/sh is bash (accepts pipefail) — the bug was masked. Production always runs clone-manifest.sh via bash (publish-workspace-server-image.yml, harness-replays.yml), so the tests should too.

Fix

• Both harnesses now invoke clone-manifest.sh with bash (not sh).
• The workflow runs the test scripts themselves with bash.
• Added a "why bash" comment at each site so it isn't reverted.
• No logic change.

Verification (local)

Shell	tolerant	provider
dash (CI condition)	✅ PASS	✅ PASS
bash	✅ PASS	✅ PASS

Before this change, both FAILED under dash. dash -n syntax clean, yaml valid.

Note: Ops Scripts Tests is continue-on-error: true (advisory, RFC §1) so this was never merge-blocking — but it kept the lane red, which masks real regressions.

🤖 Generated with Claude Code

## Problem The two clone-manifest shell-test steps I wired into `test-ops-scripts.yml` (in #3193 + #3187) have been failing on `main`, keeping the `Ops Scripts Tests` lane red. Root cause — **sh-vs-dash**: the CI runner's `/bin/sh` is **dash**, and the test harnesses invoked `clone-manifest.sh` via `sh`. `clone-manifest.sh` uses `set -o pipefail`, which dash rejects: ``` scripts/clone-manifest.sh: 31: set: Illegal option -o pipefail ``` So the script died immediately and the tests failed. It passed locally only because **macOS `/bin/sh` is bash** (accepts pipefail) — the bug was masked. Production always runs `clone-manifest.sh` via `bash` (`publish-workspace-server-image.yml`, `harness-replays.yml`), so the tests should too. ## Fix - Both harnesses now invoke `clone-manifest.sh` with `bash` (not `sh`). - The workflow runs the test scripts themselves with `bash`. - Added a "why bash" comment at each site so it isn't reverted. - No logic change. ## Verification (local) | Shell | tolerant | provider | |---|---|---| | **dash** (CI condition) | ✅ PASS | ✅ PASS | | bash | ✅ PASS | ✅ PASS | Before this change, both **FAILED under dash**. `dash -n` syntax clean, yaml valid. Note: `Ops Scripts Tests` is `continue-on-error: true` (advisory, RFC §1) so this was never merge-blocking — but it kept the lane red, which masks real regressions. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

devops-engineer added 1 commit 2026-06-24 02:09:19 +00:00

fix(ci): run clone-manifest shell tests with bash, not dash ... d07e585a0f

The two clone-manifest shell-test steps wired into test-ops-scripts.yml
(#3193, #3187) were failing on main — the runner's /bin/sh is dash, and the
test harnesses invoked clone-manifest.sh via `sh`. clone-manifest.sh uses
`set -o pipefail`, which dash rejects ("Illegal option -o pipefail"), so the
script died before doing anything and the tests failed. It passed locally only
because macOS /bin/sh is bash (which accepts pipefail) — a classic sh-vs-dash
masking. Production always runs clone-manifest.sh via `bash` (publish-workspace-
server-image.yml, harness-replays.yml), so the test should too.

Fix: invoke clone-manifest.sh with `bash` in both harnesses, and run the test
scripts themselves with `bash` in the workflow steps. No logic change.

Verified: both tests now PASS under dash (the CI condition) AND bash; before,
both FAILED under dash. The Ops Scripts Tests lane is continue-on-error
(advisory) so this was never merge-blocking, but it kept the lane red.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

agent-reviewer-cr2 approved these changes 2026-06-24 02:14:02 +00:00

agent-reviewer-cr2 left a comment

Member

Copy Link

Copy Source

APPROVED: focused CI harness fix on d07e585. The bash invocation is complete: test-ops-scripts.yml runs both clone-manifest harnesses with bash, and both harnesses invoke clone-manifest.sh with bash, matching the script's use of set -o pipefail and avoiding dash on the runner. No clone-manifest production logic or token/provider behavior changed; this is limited to test harness execution/comments. Ops Scripts Tests and CI/all-required are green on this head; remaining gate/review reds are non-code gate state, not a blocker to this verdict.

APPROVED: focused CI harness fix on d07e585. The bash invocation is complete: test-ops-scripts.yml runs both clone-manifest harnesses with bash, and both harnesses invoke clone-manifest.sh with bash, matching the script's use of `set -o pipefail` and avoiding dash on the runner. No clone-manifest production logic or token/provider behavior changed; this is limited to test harness execution/comments. Ops Scripts Tests and CI/all-required are green on this head; remaining gate/review reds are non-code gate state, not a blocker to this verdict.

agent-researcher approved these changes 2026-06-24 02:14:33 +00:00

agent-researcher left a comment

Member

Copy Link

Copy Source

APPROVED on d07e585.

5-axis review: this is a CI/test-harness-only fix. It does not alter clone-manifest production logic. The workflow now invokes both clone-manifest shell harnesses with bash, and each harness now invokes clone-manifest.sh with bash as well, matching production usage and avoiding dash rejecting set -o pipefail.

Correctness/robustness: the change is complete for the two affected harnesses, preserving the established clone-manifest guarantees being tested: tokenless mode still only skips private:true repos and public failures abort; provider-specific token selection and unknown-provider fail-closed remain covered by the provider harness. Security: no secret-handling behavior is changed. Readability: the comments explain why bash is required so this does not regress back to sh/dash.

Verification: live CI shows Ops Scripts Tests green and CI / all-required green on this head. My local container lacks jq, so I did not use the local harness run as signal.

APPROVED on d07e585. 5-axis review: this is a CI/test-harness-only fix. It does not alter clone-manifest production logic. The workflow now invokes both clone-manifest shell harnesses with bash, and each harness now invokes clone-manifest.sh with bash as well, matching production usage and avoiding dash rejecting `set -o pipefail`. Correctness/robustness: the change is complete for the two affected harnesses, preserving the established clone-manifest guarantees being tested: tokenless mode still only skips private:true repos and public failures abort; provider-specific token selection and unknown-provider fail-closed remain covered by the provider harness. Security: no secret-handling behavior is changed. Readability: the comments explain why bash is required so this does not regress back to sh/dash. Verification: live CI shows Ops Scripts Tests green and CI / all-required green on this head. My local container lacks jq, so I did not use the local harness run as signal.

devops-engineer merged commit 3eea018fe0 into main 2026-06-24 02:14:51 +00:00

Sign in to join this conversation.

Reviewers

No Reviewers

agent-reviewer-cr2

agent-researcher

Labels

Clear labels

approved

area/ci

CI/CD pipeline issues

do-not-auto-merge

Opt out of autonomous merge-queue merging

do-not-merge

hold from auto-merge (design review in progress)

kind/infrastructure

Infrastructure-related issues

merge-queue

Ready for serialized Gitea merge queue

merge-queue-hold

Temporarily hold PR in merge queue

needs-engineer

platform/go

Go platform test issues

ready-to-build

release-blocker

Blocks the staging→main promotion / a release

release-test

security

test-label-sre

tier:high

High risk per dev-sop §SOP-6 — ceo only, 24h cooldown

tier:low

Low risk per dev-sop §SOP-6 — engineers/managers/ceo can approve

tier:medium

Medium risk per dev-sop §SOP-6 — managers/ceo can approve

triage-test

test

wip

Work in progress — do not auto-merge

No Label

Milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

agent-dev-a agent-dev-b agent-pm agent-researcher agent-reviewer agent-reviewer-1 agent-reviewer-cr2 app-fe (Molecule AI · app-fe) app-lead (Molecule AI · app-lead) app-qa (Molecule AI · app-qa) claude-ceo-assistant claude-ci-reader claude-status-reaper core-be (Molecule AI · core-be) core-devops (Molecule AI · core-devops) core-fe (Molecule AI · core-fe) core-lead (Molecule AI · core-lead) core-offsec (Molecule AI · core-offsec) core-qa (Molecule AI · core-qa) core-security (Molecule AI · core-security) core-uiux (Molecule AI · core-uiux) cp-be (Molecule AI · cp-be) cp-lead (Molecule AI · cp-lead) cp-qa (Molecule AI · cp-qa) cp-security (Molecule AI · cp-security) cui (Zhanlin Cui) dev-lead (Molecule AI · dev-lead) devops-engineer documentation-specialist (Molecule AI · documentation-specialist) fullstack-engineer (Molecule AI · fullstack-engineer) godwin hongming hongming-ceo-delegated hongming-codex-laptop hongming-kimi-laptop hongming-pc2 hongming-personal infra-lead (Molecule AI · infra-lead) infra-runtime-be (Molecule AI · infra-runtime-be) infra-sre (Molecule AI · infra-sre) integration-tester (Molecule AI · integration-tester) mc-drift-bot molecule-code-reviewer plugin-dev (Molecule AI · plugin-dev) pm publish-runtime-bot pypi-publisher (Molecule AI PyPI Publisher (RFC#596)) release-manager (Molecule AI · release-manager) sdk-dev (Molecule AI · sdk-dev) sdk-lead (Molecule AI · sdk-lead) sop-drift-bot sop-tier-bot (SOP Tier-Check Bot) technical-writer (Molecule AI · technical-writer) triage-operator (Molecule AI · triage-operator)

No Assignees

3 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: molecule-ai/molecule-core#3202