brew test-bot --only-setup fails on ubuntu-22.04-arm partner runner image

[ReenigneArcher]

This worked yesterday, but is failing today.

  ==> Downloading https://ghcr.io/v2/homebrew/core/portable-ruby/blobs/sha256:56b0017d634509e49272a6eccd88f888dd4031404e230f9defb3b21707781310
  #=#=#                                                                         
                                                                             0.0%
  #############                                                             18.2%
  #################################################                         68.7%
  ######################################################################## 100.0%
  ==> Pouring portable-ruby-3.4.8.arm64_linux.bottle.tar.gz
  ==> Using Homebrew/brew 5.0.6-64-gb64029d4f9 (Merge pull request #21282 from Homebrew/dependabot/bundler/Library/Homebrew/bundler-bb4f7fe41f)
  ==> Testing lizardbyte/homebrew-homebrew (LizardByte/Sunshine) 627d301 (sunshine 0.0.4484):
  ==> Running Setup#run!
  ==> brew install-bundler-gems --add-groups=ast,audit,bottle,formula_test,livecheck,style
  ==> FAILED
Full install-bundler-gems --add-groups=ast,audit,bottle,formula_test,livecheck,style output
  Fetching gem metadata from https://rubygems.org/.......
  Fetching public_suffix 7.0.0
  Fetching ast 2.4.3
  Fetching base64 0.3.0
  Fetching bigdecimal 4.0.1
  Installing base64 0.3.0
  Installing ast 2.4.3
  Fetching bindata 2.5.1
  Installing bigdecimal 4.0.1 with native extensions
  Installing public_suffix 7.0.0
  Fetching concurrent-ruby 1.3.5
  Fetching hana 1.3.7
  Installing bindata 2.5.1
  Fetching json 2.18.0
  Installing hana 1.3.7
  Fetching regexp_parser 2.11.3
  Installing concurrent-ruby 1.3.5
  Fetching simpleidn 0.2.3
  Installing json 2.18.0 with native extensions
  Installing regexp_parser 2.11.3
  Installing simpleidn 0.2.3
  Fetching language_server-protocol 3.17.0.5
  Fetching lint_roller 1.1.0
  Installing language_server-protocol 3.17.0.5
  Installing lint_roller 1.1.0
  Fetching logger 1.7.0
  Installing logger 1.7.0
  Fetching minitest 5.27.0
  Installing minitest 5.27.0
  Fetching parallel 1.27.0
  Installing parallel 1.27.0
  Fetching racc 1.8.1
  Fetching plist 3.7.2
  Installing racc 1.8.1 with native extensions
  Installing plist 3.7.2
  Fetching prism 1.7.0
  Installing prism 1.7.0 with native extensions
  Fetching rainbow 3.1.1
  Installing rainbow 3.1.1
  Fetching rexml 3.4.4
  Installing rexml 3.4.4
  Fetching ruby-progressbar 1.13.0
  Installing ruby-progressbar 1.13.0
  Fetching unicode-emoji 4.1.0
  Installing unicode-emoji 4.1.0
  Fetching ruby-macho 4.1.0
  Installing ruby-macho 4.1.0
  Fetching sorbet-runtime 0.6.12845
  Installing sorbet-runtime 0.6.12845
  Fetching test-prof 1.5.0
  Installing test-prof 1.5.0
  Fetching warning 1.5.0
  Installing warning 1.5.0
  Bundler cannot reinstall base64-0.3.0 because there's a previous installation of
  it at
  /home/linuxbrew/.linuxbrew/Homebrew/Library/Homebrew/vendor/bundle/ruby/3.4.0/gems/base64-0.3.0
  that is unsafe to remove.
  The parent of
  /home/linuxbrew/.linuxbrew/Homebrew/Library/Homebrew/vendor/bundle/ruby/3.4.0/gems/base64-0.3.0
  is world-writable and does not have the sticky bit set, making it insecure to
  remove due to potential vulnerabilities.
  Please change the permissions of
  /home/linuxbrew/.linuxbrew/Homebrew/Library/Homebrew/vendor/bundle/ruby/3.4.0/gems
  or choose a different install path.
  Error: failed to run `/home/linuxbrew/.linuxbrew/Homebrew/Library/Homebrew/vendor/portable-ruby/3.4.8/bin/bundle install`!

I found this related discussion (ruby/rubygems#7983), which seems to indicate that updating bundler to 2.5.19 may fix this? But it seems to already allow installing anything greater than the version specified here: https://github.com/Homebrew/brew/blob/b64029d4f999b8963d0dadb925d3b484207c1cee/Library/Homebrew/Gemfile.lock#L148

[ReenigneArcher]

To workaround the issue, I added the following to my workflow

      - name: Fix ruby gems directory permissions
        if: matrix.os == 'ubuntu-22.04-arm'
        run: |
          # Fix ownership first so current user can write, then remove world-writable
          BUNDLE_DIR="$(brew --prefix)/Homebrew/Library/Homebrew/vendor/bundle/ruby"
          if [ -d "${BUNDLE_DIR}" ]; then
            # Take ownership so we can write to it
            sudo chown -R "$(whoami):$(id -gn)" "${BUNDLE_DIR}"
            # Remove world-writable permissions to satisfy Bundler security
            chmod -R o-w "${BUNDLE_DIR}"
            echo "Fixed ownership and permissions for ${BUNDLE_DIR}"
          fi

This is after the uses: Homebrew/actions/setup-homebrew@main and cache steps... and before the brew test-bot --fail-fast --only-cleanup-before and brew test-bot --fail-fast --only-setup steps.

It's a hack and I used copilot to solve it. Hopefully there's a better solution available. I don't think the hack is really required since this worked on December 18th.