[Bala (0xba1a)]

Summary

Tool definitions for Azure Linux and RPM work: rpm.yaml, mock.yaml and azldev.yaml. They use the distro-specific commands from #205 and are designed for the stock Azure Linux sandbox (#207) with sudo_access=True (#208).

The agent runs mock and azldev as itself (the host uid), through its mock group membership. mock's setuid launcher does the privileged work. So files they write into the repository stay owned by the host user, and the agent doesn't need to run either tool with sudo.

Changes

• rpm.yaml: rpm, rpmbuild, rpmspec, rpm2cpio, createrepo_c. Install commands for azurelinux (tdnf) and debian (apt-get).
• mock.yaml (Azure Linux only):
  • installs mock and mock-rpmautospec from the Azure Linux repos and adds the agent to the mock group. Both mock and azldev check the group database, not the running process's groups, so the membership applies to the already-running shell;
  • verification fails fast with a clear message when no-new-privileges blocks mock's setuid launcher, i.e. when sudo_access is off;
  • installing it on Debian fails with UnsupportedDistroError.
• azldev.yaml (Azure Linux and Debian):
  • installs Azure Linux Dev Tools with go install, using the version pinned by the mounted repository's .azldev-version, or the latest release if there's no pin;
  • the shared install steps are reused across distros through a YAML anchor;
  • it runs as the agent, so no root override is needed.
• Docs: an "Azure Linux build tools" section on the Sandbox Images page.

Testing

• Unit: each YAML parses and resolves per distro. mock is Azure Linux only, has no root wrapper, adds the agent to the mock group, and its verify step never calls exit in the shared shell. azldev shares its install step across distros and has no root override.
• Integration: the new test/tools/test_azurelinux_build_tools.py installs and verifies all three tools on the stock Azure Linux image with sudo_access=True.
• Manual: on the stock Azure Linux image with sudo_access=True and the Azure Linux repo mounted, all three tools installed in about 65 seconds. The agent then ran azldev comp render -p util-linux without sudo, as uid 1000 with only its own group in the process. It succeeded and wrote 18 files into the repository, all owned by the agent and none by root.
• End to end (CopilotBot from the next PR): with its azldev skills, the agent upgraded util-linux from 2.41.5 to 2.42.4 without running sudo.

These ran on this commit before it was rebased onto main. The rebase only replaced #208's commit with its squash merge (identical content) and picked up an unrelated GitHub Actions bump (#206).

Upcoming PRs in this stack

1. refactor(env): run stock MCR images, prepare the sandbox on the fly #202 (merged): stock MCR images prepared on the fly.
2. feat(tools): distro-aware tool commands #205 (merged): distro-aware tool commands.
3. feat(env): Azure Linux 3 sandbox image #207 (merged): Azure Linux 3 sandbox and image on the bots.
4. feat(env): optional passwordless sudo for the sandbox agent #208 (merged): optional passwordless sudo for the sandbox agent.
5. This PR: rpm / mock / azldev tool definitions.
6. CopilotBot session_options and skill tracking, so it can use a repository's agent skills.

[Codecov Comments Bot (codecov-commenter)]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 77.22%. Comparing base (a2f7e2e) to head (eccec63).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #209   +/-   ##
=======================================
  Coverage   77.22%   77.22%           
=======================================
  Files          47       47           
  Lines        3219     3219           
=======================================
  Hits         2486     2486           
  Misses        733      733           

Flag	Coverage Δ
ghcp	31.87% <ø> (ø)
integration	42.49% <ø> (-0.13%)	⬇️
ollama_local	34.42% <ø> (-0.13%)	⬇️
slow-browser	18.35% <ø> (ø)
slow-other	39.51% <ø> (+0.43%)	⬆️
unit	74.83% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.