swamp-club/swamp-extensions
Watch
6
0
Fork
You've already forked swamp-extensions
 0
Code Pull requests 1 Activity Actions

fix(ci): remove TTY hack from publish workflow #222

Merged
stack72 merged 1 commit from worktree-cosmic-sniffing-hare into main 2026-08-24 21:20:46 +00:00
Conversation 2 Commits 1 Files changed 1 -2
stack72 commented 2026-08-24 21:14:03 +00:00
Owner
Copy link

Summary

Removes the rm -f /dev/tty workaround from the publish workflow that was added to prevent install.sh from hanging on the interactive SWAMP CLUB login prompt during CI runs.

Problem

The publish job intermittently failed because the TTY hack (rm -f /dev/tty) requires permissions that Forgejo runners may or may not have. When the runner couldn't remove the device node, install.sh would detect a TTY via [ -e /dev/tty ] && [ -t 1 ] and block waiting for user input on the SWAMP CLUB signup prompt, hanging the job until timeout.

The flakiness came from the fact that /dev/tty exists as a kernel device node on most Linux systems regardless of whether a real terminal is attached — so rm -f /dev/tty was racing against runner permissions and device allocation.

Fix

The upstream install.sh now checks for the CI environment variable before attempting TTY detection, and skips the interactive prompt entirely when it's set. See swamp-club/swamp#2242.

Since Forgejo Actions (like all major CI systems) sets CI=true automatically, the install script will skip the prompt without any workaround needed on the consumer side.

Impact

  • Publish jobs will no longer intermittently fail due to TTY permission issues
  • No behavioral change — the interactive prompt was never useful in CI and the rm -f /dev/tty was the only thing attempting to suppress it

Co-authored-by: Paul Stack paul@swamp-club.com

## Summary Removes the `rm -f /dev/tty` workaround from the publish workflow that was added to prevent `install.sh` from hanging on the interactive SWAMP CLUB login prompt during CI runs. ## Problem The publish job intermittently failed because the TTY hack (`rm -f /dev/tty`) requires permissions that Forgejo runners may or may not have. When the runner couldn't remove the device node, `install.sh` would detect a TTY via `[ -e /dev/tty ] && [ -t 1 ]` and block waiting for user input on the SWAMP CLUB signup prompt, hanging the job until timeout. The flakiness came from the fact that `/dev/tty` exists as a kernel device node on most Linux systems regardless of whether a real terminal is attached — so `rm -f /dev/tty` was racing against runner permissions and device allocation. ## Fix The upstream `install.sh` now checks for the `CI` environment variable before attempting TTY detection, and skips the interactive prompt entirely when it's set. See [swamp-club/swamp#2242](https://github.com/swamp-club/swamp/pull/2242). Since Forgejo Actions (like all major CI systems) sets `CI=true` automatically, the install script will skip the prompt without any workaround needed on the consumer side. ## Impact - Publish jobs will no longer intermittently fail due to TTY permission issues - No behavioral change — the interactive prompt was never useful in CI and the `rm -f /dev/tty` was the only thing attempting to suppress it Co-authored-by: Paul Stack <paul@swamp-club.com>
fix(ci): remove TTY hack from publish workflow
All checks were successful
CI: Reviews / Detect Changes (pull_request) Successful in 1m4s
Details
CI: Reviews / Adversarial Code Review (pull_request) Has been skipped
Details
CI / Actions Audit (pull_request) Successful in 1m4s
Details
CI: Reviews / Claude Code Review (pull_request) Successful in 1m53s
Details
CI / Dependency Audit (pull_request) Successful in 3m33s
Details
CI: Reviews / CI Security Review (pull_request) Successful in 2m20s
Details
CI / Gate: Audit (pull_request) Successful in 0s
Details
CI: Reviews / Gate: Reviews (pull_request) Successful in 0s
Details
d8bcc72f26
 
The `rm -f /dev/tty` workaround was unreliable — it requires
permissions that runners may not have, causing intermittent publish
failures. The upstream install.sh now checks for the CI env var
(swamp-club/swamp#2242) and skips the interactive prompt automatically,
making this hack unnecessary.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
stack72 commented 2026-08-24 21:18:55 +00:00
Author
Owner
Copy link

Code Review

Blocking Issues

None.

Suggestions

None.

Summary: This PR removes the rm -f /dev/tty step that was added as a workaround to suppress interactive prompts from the swamp CLI. The fix is correct and clean:

  • swamp extension push manifest.yaml --yes already passes --yes, which is the proper way to opt into non-interactive mode.
  • swamp repo init --quiet --tool none already passes --quiet for the same reason.

Destroying /dev/tty is an aggressive and side-effect-prone hack (it affects every process in the runner for the rest of the job). Using the CLI's own flags is the right approach. The removal is safe.

No security, correctness, or compliance issues found.

## Code Review ### Blocking Issues None. ### Suggestions None. --- **Summary:** This PR removes the `rm -f /dev/tty` step that was added as a workaround to suppress interactive prompts from the `swamp` CLI. The fix is correct and clean: - `swamp extension push manifest.yaml --yes` already passes `--yes`, which is the proper way to opt into non-interactive mode. - `swamp repo init --quiet --tool none` already passes `--quiet` for the same reason. Destroying `/dev/tty` is an aggressive and side-effect-prone hack (it affects every process in the runner for the rest of the job). Using the CLI's own flags is the right approach. The removal is safe. No security, correctness, or compliance issues found.
stack72 commented 2026-08-24 21:19:29 +00:00
Author
Owner
Copy link

CI Security Review

File reviewed: .forgejo/workflows/publish.yml

Change summary: Removes a rm -f /dev/tty step ("Disable TTY to prevent interactive prompts") from the publish job. No other changes.

Checklist

Category Status Notes
Prompt Injection N/A No LLM interaction in this workflow
Expression Injection Pass No untrusted data interpolated in run: blocks. ${{ toJson(matrix.chunk) }} is safely passed via env:, not inline. ${{ strategy.job-index }} in the job name is a safe numeric value.
Dangerous Triggers Pass Trigger is push to main only — requires repo write access
Supply Chain Pass actions/checkout@v6 (GitHub-owned, trusted) and systeminit/setup-swamp@v0.1.0 (trusted publisher per policy)
Permissions Pass contents: read set at both workflow-level (line 8) and job-level (lines 19, 55). Minimum necessary for checkout + publish. No id-token: write or contents: write.
Secret Exposure Pass SWAMP_API_KEY is passed only to setup-swamp via with:, the standard pattern. Not interpolated in run: blocks.
Auto-merge N/A No merge behavior in this workflow

Verdict

PASS — The change removes an unnecessary rm -f /dev/tty hack, which is a minor cleanup with no security impact. The overall workflow has sound security posture: minimal permissions, safe expression handling, trusted action pins, and secrets properly scoped.

## CI Security Review **File reviewed:** `.forgejo/workflows/publish.yml` **Change summary:** Removes a `rm -f /dev/tty` step ("Disable TTY to prevent interactive prompts") from the `publish` job. No other changes. ### Checklist | Category | Status | Notes | |----------|--------|-------| | Prompt Injection | N/A | No LLM interaction in this workflow | | Expression Injection | Pass | No untrusted data interpolated in `run:` blocks. `${{ toJson(matrix.chunk) }}` is safely passed via `env:`, not inline. `${{ strategy.job-index }}` in the job name is a safe numeric value. | | Dangerous Triggers | Pass | Trigger is `push` to `main` only — requires repo write access | | Supply Chain | Pass | `actions/checkout@v6` (GitHub-owned, trusted) and `systeminit/setup-swamp@v0.1.0` (trusted publisher per policy) | | Permissions | Pass | `contents: read` set at both workflow-level (line 8) and job-level (lines 19, 55). Minimum necessary for checkout + publish. No `id-token: write` or `contents: write`. | | Secret Exposure | Pass | `SWAMP_API_KEY` is passed only to `setup-swamp` via `with:`, the standard pattern. Not interpolated in `run:` blocks. | | Auto-merge | N/A | No merge behavior in this workflow | ### Verdict **PASS** — The change removes an unnecessary `rm -f /dev/tty` hack, which is a minor cleanup with no security impact. The overall workflow has sound security posture: minimal permissions, safe expression handling, trusted action pins, and secrets properly scoped.
stack72 deleted branch worktree-cosmic-sniffing-hare 2026-08-24 21:20:46 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
swamp-club/swamp-extensions!222
No description provided.