Use sshv2 for the snapshot scrub e2e exec steps - #327
Conversation
The provider-native `sandbox ssh` steps in api-snapshot-scrub.yaml failed against staging with `exec request failed on channel 0` (exit 255). The same scripts run clean over the beta direct WebSocket transport, so both steps now use `sandbox sshv2`. sshv2 authenticates with the caller's user-owned SSH key, which the case cannot assume is already registered, so a leading step registers the local identity's public half under a run-unique name and declares it as a resource for cleanup. `secret ssh-key create` reuses an existing local keypair rather than regenerating one, so it never overwrites ~/.ssh/amika_id_ed25519. Note that sshv2 writes its managed SSH config into the invoking user's real ~/.ssh/ rather than the per-run state directory, so this case is less isolated than the rest of the suite. KAPRO-753 tracks making the v2 commands respect an alternative home.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 4ab3ed06f2
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| # ~/.ssh/amika_id_ed25519 and never overwrites it. The run-unique name means | ||
| # the key this case deletes is always one it registered. | ||
| - name: register the local SSH public key for sshv2 | ||
| cmd: [secret, ssh-key, create, --name, "e2e-scrub-{{run_id}}", -o, json] |
There was a problem hiding this comment.
When this E2E case runs on a machine whose v2 SSH identity was configured with secret ssh-keygen --import, ssh-key create calls ConfigureSession and replaces the persisted SessionConfig with ~/.ssh/amika_id_ed25519. Because SSH state and config are written under the caller's real home despite the runner's isolated AMIKA_STATE_DIRECTORY, and cleanup only deletes the remote key, the test permanently loses the imported identity selection and may leave subsequent sshv2 commands using a key that cleanup just unregistered. Preserve and restore the existing session configuration, or defer this case until its SSH files can be isolated.
Useful? React with 👍 / 👎.
1 participant
The provider-native
sandbox sshsteps in api-snapshot-scrub.yaml failed against staging withexec request failed on channel 0(exit 255). The same scripts run clean over the beta direct WebSocket transport, so both steps now usesandbox sshv2.sshv2 authenticates with the caller's user-owned SSH key, which the case cannot assume is already registered, so a leading step registers the local identity's public half under a run-unique name and declares it as a resource for cleanup.
secret ssh-key createreuses an existing local keypair rather than regenerating one, so it never overwrites ~/.ssh/amika_id_ed25519.Note that sshv2 writes its managed SSH config into the invoking user's real ~/.ssh/ rather than the per-run state directory, so this case is less isolated than the rest of the suite. KAPRO-753 tracks making the v2 commands respect an alternative home.