ci(#1512): start the Podman API socket with systemd in functional-tests

[waynesun09]

Summary

Follow-up to #1513. Since fullsend moved to OpenShell 0.1.2 (fullsend-ai/fullsend#7233), every functional-tests job fails at Install OpenShell CLI: the gateway restarts in a loop with no responsive Podman API socket found; set OPENSHELL_PODMAN_SOCKET or configure socket_path (for example main runs 36618808697 and 36621412613, and open PRs). OpenShell 0.1 pins the podman compute driver and checks the socket when the gateway starts; 0.0.116 did not.

The workflow started the Podman API with a background podman system service from a step. fullsend's action.yml, which runs successfully on the same hosted runners, starts it with systemctl --user start podman.socket. This does the same and waits until the socket answers.

Testing

• actionlint passes.
• workflow_dispatch of this branch's functional-tests (run 36623066239): Install OpenShell CLI passes in all five legs (code, fix, retro, review, triage) and the gateway starts.
• CI on this PR cannot pass before it merges. functional-tests runs main's workflow (pull_request_target), so the required functional-tests-complete stays red until this lands. Open PRs go green by re-running their failed jobs after it merges; they don't need a rebase.

The same fix for fullsend: fullsend-ai/fullsend#7845.

[qodo-code-review]

PR Summary by Qodo

Start the Podman API socket with systemd in functional tests

🐞 Bug fix ⚙️ Configuration changes 🕐 10-20 Minutes

AI Description

• Replace the background Podman API process with a systemd-managed user socket.
• Verify the API responds before installing OpenShell, preventing gateway startup failures.

Diagram

graph TD
  A["Functional tests"] --> B["Start user socket"] --> C["Podman API"] --> D["OpenShell gateway"] --> E["Run agent tests"]

Loading

High-Level Assessment

Use the systemd user socket: it gives the gateway a service-managed Podman endpoint across workflow steps. Retaining a background process would preserve the lifecycle issue this change addresses.

Files changed (1) +12 / -9

Bug fix (1) +12 / -9

functional-tests.ymlStart and verify the systemd-managed Podman socket +12/-9

Start and verify the systemd-managed Podman socket

• Starts podman.socket through the user's systemd instance instead of launching a background Podman service. Polls the API and fails with the socket path if it never responds, before OpenShell installation begins.

.github/workflows/functional-tests.yml

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 🔗 Cross-repo conflicts (0) 📜 Skill insights (0)

1. Socket failures can inject workflow commands ✗ Dismissed

Description

The new ::error:: message interpolates SOCKET_PATH without sanitizing the value derived from
XDG_RUNTIME_DIR. If the socket check fails and that environment value contains workflow-command
syntax or control characters, the diagnostic passes them to the Actions log parser.

Code

.github/workflows/functional-tests.yml[313]

+            || { echo "::error::Podman socket not ready at ${SOCKET_PATH}"; exit 1; }

Relevance

●●● Strong

Recent workflow-command sanitization findings were accepted for interpolated values in GitHub
Actions errors.

PR-#1244
PR-#90

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The changed failure path inserts SOCKET_PATH, which is derived from XDG_RUNTIME_DIR, directly
into a GitHub Actions error command. The cited rule requires each interpolated value to be
sanitized.

.github/workflows/functional-tests.yml[306-313]
Skill: code-review

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The socket-failure annotation interpolates an unsanitized path into a GitHub Actions workflow command.

## Fix Focus Areas
- .github/workflows/functional-tests.yml[312-313]

## Recommended Fix
Emit a static `::error::` annotation and print the socket path separately as ordinary diagnostic text, or sanitize the entire interpolated path before including it in the annotation.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

2. Workflow change needs human approval ✗ Dismissed

Description

The PR changes .github/workflows/functional-tests.yml, a protected infrastructure path that
requires human review even when the change is justified. The description links the socket fix to
issue #1512, but the protected-path review requirement still applies before approval.

Code

.github/workflows/functional-tests.yml[306]

+          systemctl --user start podman.socket

Relevance

●● Moderate

Protected-path governance is plausible, but similar inline approval-justification findings were
rejected.

PR-#754

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The PR adds a systemd command to a file under .github/. The cited rule explicitly requires a
protected-path finding and human approval for changes there, including justified changes.

.github/workflows/functional-tests.yml[299-313]
Skill: pr-review

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
This PR modifies a protected workflow path and must not be auto-approved; the PR description provides the issue context for the change.

## Fix Focus Areas
- .github/workflows/functional-tests.yml[299-313]

## Recommended Fix
Route the workflow change to a human reviewer for approval before merging.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

Context sources

✅ Compliance rules (platform): 58 rules

✅ Skills: 4 invoked

  code-review

  code-implementation

  pr-review

  docs-review

✅ Cross-repo context — repo relationships

  Explored: repo: fullsend-ai/fullsend (sha: cf42bb73) — View relationship

Review mode: ⚖️ Balanced: This is a localized CI workflow behavior change that affects functional-test job reliability and systemd/Podman socket readiness, warranting a careful single-pass review.

Tip of the day

💡 Did you know, you can add REVIEW.md to your repo root and Qodo follows it on every PR

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[fullsend-ai-review]

🤖 Review · ⚠️ Cancelled · Started 8:05 PM UTC · Ended 8:10 PM UTC

Commit: 82eacb8 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 8:12 PM UTC · Completed 8:20 PM UTC

Commit: 7470786 · View workflow run →

Runtime: pi · Model: sonnet → claude-sonnet-5 · Effort: high · Cost: $1.51

[fullsend-ai-review]

Risk Assessment: moderate (2/5)

Details

Small (23-line), single-file CI workflow fix by a repo-admin author, authorized as a maintainer follow-up to #1512/#1513; moderate score driven mainly by it being a CI-workflow and protected-path change plus some historical churn/fix-commit signal on the file, offset by low blast radius and no security-sensitive or dependency changes.

[fullsend-ai-review]

Review

Findings

Medium

• [protected-path] .github/workflows/functional-tests.yml — This PR modifies a file under a protected/governance path (.github/). Sufficient context is present: the PR links to issues Declare provider credentials in profiles and drop _NOOP_* placeholders for OpenShell 0.1 #1512 and fix(#1512)!: declare profile credentials for OpenShell 0.1 #1513, and the description explains the rationale (fixing a functional-tests CI failure introduced by fullsend's move to OpenShell 0.1.2, which now requires a responsive Podman API socket at gateway startup) with supporting evidence (failing run links, a passing workflow_dispatch validation run, and actionlint passing). Human maintainer approval is still always required for protected-path changes, regardless of context.

No correctness, security, style, or intent-coherence issues were found. The dimension sub-agents independently verified: the runner already runs OpenShell as a systemd user service so systemctl --user start podman.socket is available; the readiness poll now checks actual API responsiveness (podman info) rather than only socket existence; the added systemctl --user status / journalctl --user diagnostics on timeout do not expose secrets or use unsanitized values in GHA workflow commands; and the change traces cleanly to an already-authorized maintainer-only follow-up chain (#1512 → #1513 → this PR) with no scope creep.

[waynesun09]

Correction to "re-running failed jobs is enough" above: a re-run replays the workflow as it was resolved for the PR's original pull_request_target event, so it still runs the pre-fix workflow and fails again at Install OpenShell CLI. An open PR picks up this fix only from a new event: push to the branch (updating it from main works), close and reopen it, or add the ok-to-test label.