From 97d7195077700394a69cd0ea04924c0f3dcf26f6 Mon Sep 17 00:00:00 2001 From: Randy Fay Date: Mon, 24 Aug 2026 12:30:39 -0600 Subject: [PATCH] ci: fix scheduled link-check sweep crashing on ubuntu-24.04 sandbox restriction MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The sweep job runs linkspector directly via npx, unlike the PR job which goes through action-linkspector. ubuntu-24.04 runners restrict unprivileged user namespaces via AppArmor, which Chromium's sandbox needs to launch; action-linkspector already works around this internally, but the bare npx invocation did not, so every scheduled/manual sweep run crashed with "No usable sandbox!" instead of producing a report. ## Summary - Add a step to the sweep job that disables the AppArmor user-namespace restriction before running linkspector, mirroring the workaround action-linkspector applies for the PR job. ## Test plan - [ ] Trigger the workflow manually (workflow_dispatch) and confirm the sweep job completes and produces JSON output instead of crashing. 🤖 Developed with assistance from [Claude Code](https://claude.ai/code) Co-authored-by: Claude Sonnet 5 --- .github/workflows/link-check.yml | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/.github/workflows/link-check.yml b/.github/workflows/link-check.yml index b54d97c0..250c28c1 100644 --- a/.github/workflows/link-check.yml +++ b/.github/workflows/link-check.yml @@ -61,6 +61,17 @@ jobs: with: node-version: ${{ env.NODE_VERSION }} + # ubuntu-24.04 runners restrict unprivileged user namespaces via AppArmor, + # which Chromium's sandbox needs to launch. action-linkspector (used in the + # pr job above) works around this itself; a bare `npx linkspector` here + # does not, so it crashes with "No usable sandbox!" on every scheduled run. + # See https://chromium.googlesource.com/chromium/src/+/main/docs/security/apparmor-userns-restrictions.md + - name: Allow Chromium's user-namespace sandbox + run: | + if [ -f /proc/sys/kernel/apparmor_restrict_unprivileged_userns ]; then + echo 0 | sudo tee /proc/sys/kernel/apparmor_restrict_unprivileged_userns + fi + - name: Run linkspector id: check run: |