From 0d1f36d493ae7a0ed1e501af55d2a36603f79a7b Mon Sep 17 00:00:00 2001 From: Dotta Date: Wed, 2 Sep 2026 17:05:44 -0500 Subject: [PATCH] ci(runner): qualify hosted Node interpreter --- .github/workflows/runner-full-stack-e2e.yml | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/.github/workflows/runner-full-stack-e2e.yml b/.github/workflows/runner-full-stack-e2e.yml index 102fe0b642..8506d689c2 100644 --- a/.github/workflows/runner-full-stack-e2e.yml +++ b/.github/workflows/runner-full-stack-e2e.yml @@ -333,6 +333,18 @@ jobs: if: matrix.environmentId == 'local' && (matrix.profileId == 'runner-opencode' || startsWith(matrix.profileId, 'runner-acpx-')) run: pnpm --filter @paperclipai/paperclip-runner build:typescript + - name: Qualify local provider Node interpreter + if: matrix.environmentId == 'local' && (matrix.profileId == 'runner-opencode' || startsWith(matrix.profileId, 'runner-acpx-')) + run: | + node <<'NODE' + const fs = require("node:fs"); + const mode = fs.statSync(process.execPath).mode & 0o777; + fs.chmodSync(process.execPath, mode & ~0o022); + if ((fs.statSync(process.execPath).mode & 0o022) !== 0) { + throw new Error("provider Node interpreter remains group- or world-writable"); + } + NODE + - name: Build native remote provider pack if: matrix.environmentId == 'daytona' && (matrix.profileId == 'runner-opencode' || startsWith(matrix.profileId, 'runner-acpx-')) env: