fix: give the CI sandbox tests a working bwrap

Ubuntu 24.04 blocks the unprivileged user namespaces bubblewrap needs, so the campaign refused to run the fake cores and four FakeCorePasses tests failed, also inside the no-jsonschema replay. CI now installs bubblewrap, lifts the AppArmor restriction and proves a sandbox starts. Locally the tests name the missing sandbox instead of failing on a KeyError.

.github/workflows/validate.yml

@@ -239,6 +239,16 @@ jobs:
       - name: Check that shellcheck is installed
         run: shellcheck --version
 
+      # core_probe and the campaign run third-party cores only inside a
+      # bubblewrap sandbox and refuse without one. Ubuntu 24.04 blocks the
+      # unprivileged user namespaces bwrap needs, so the campaign tests saw
+      # "refused". The last command proves a sandbox starts.
+      - name: Give the sandbox tests a working bubblewrap
+        run: |
+          sudo apt-get install -y --no-install-recommends bubblewrap
+          sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
+          bwrap --ro-bind /usr /usr --symlink usr/lib /lib --symlink usr/lib64 /lib64 --symlink usr/bin /bin --proc /proc --dev /dev --unshare-all /bin/true
+
       # The site is built as deploy-site.yml builds it, from the lockfile.
       - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1  # v7.1.0
         with:

tests/test_campaign.py

@@ -900,6 +900,11 @@ class FakeCorePasses(Workspace):
 
     @classmethod
     def setUpClass(cls) -> None:
+        # These passes prove the cores run sandboxed. Without a working bwrap
+        # the campaign refuses, and the cause is named here instead of a KeyError.
+        _prefix, isolation = campaign.core_probe.sandbox_argv([Path(tempfile.gettempdir())])
+        if isolation != campaign.core_probe.SANDBOX:
+            raise unittest.SkipTest(f"no sandbox here ({isolation}): install bubblewrap")
         TMP.mkdir(parents=True, exist_ok=True)
         cls.build = Path(tempfile.mkdtemp(dir=TMP))
         source = cls.build / "fake.c"