ci: rehydrate Electron sandbox before validation

.github/workflows/packages.yml

@@ -44,8 +44,14 @@ jobs:
         run: |
           sudo apt-get update
           sudo apt-get install --no-install-recommends --yes xvfb xauth
-          sudo chown root:root node_modules/electron/dist/chrome-sandbox
+          sandbox="node_modules/electron/dist/chrome-sandbox"
-          sudo chmod 4755 node_modules/electron/dist/chrome-sandbox
+          if [[ ! -f "$sandbox" ]]; then
+            rm -rf node_modules/electron/dist
+            force_no_cache=true node node_modules/electron/install.js
+          fi
+          test -f "$sandbox"
+          sudo chown root:root "$sandbox"
+          sudo chmod 4755 "$sandbox"
 
       - name: Run validators
         run: |

docs/development/release-runbook.md

@@ -45,9 +45,10 @@ to a public channel; follow the user's explicit publication instruction.
   workflow. It validates and builds `out` once, then packages on six native
   runners: Windows, macOS, and Linux, each for x64 and arm64.
 - Linux source validation configures the installed Electron `chrome-sandbox`
-  helper with root ownership and mode `4755`, then runs the full test suite
+  helper with root ownership and mode `4755`, rehydrates the Electron
-  under Xvfb. Keep Electron sandboxing enabled; do not skip UI tests or add
+  distribution without cache when the helper is missing, then runs the full
-  `--no-sandbox` to work around runner setup failures.
+  test suite under Xvfb. Keep Electron sandboxing enabled; do not skip UI tests
+  or add `--no-sandbox` to work around runner setup failures.
 - The experimental Linux LoongArch (`loong64`) preview is built separately
   through `build/loongarch-cross` by following
   `docs/development/loongarch-preview-build.md`. It is not part of

tests/packages-workflow.test.ts

@@ -59,8 +59,11 @@ describe('desktop packages workflow', () => {
     expect(prepareIndex).toBeGreaterThan(installIndex)
     expect(validatorsIndex).toBeGreaterThan(prepareIndex)
     expect(steps[prepareIndex]?.run).toContain('sudo apt-get install --no-install-recommends --yes xvfb xauth')
-    expect(steps[prepareIndex]?.run).toContain('sudo chown root:root node_modules/electron/dist/chrome-sandbox')
+    expect(steps[prepareIndex]?.run).toContain('if [[ ! -f "$sandbox" ]]')
-    expect(steps[prepareIndex]?.run).toContain('sudo chmod 4755 node_modules/electron/dist/chrome-sandbox')
+    expect(steps[prepareIndex]?.run).toContain('force_no_cache=true node node_modules/electron/install.js')
+    expect(steps[prepareIndex]?.run).toContain('test -f "$sandbox"')
+    expect(steps[prepareIndex]?.run).toContain('sudo chown root:root "$sandbox"')
+    expect(steps[prepareIndex]?.run).toContain('sudo chmod 4755 "$sandbox"')
     expect(steps[validatorsIndex]?.run).toContain('xvfb-run --auto-servernum npm test')
     expect(steps[validatorsIndex]?.run).toContain('npm run typecheck')
     expect(steps[validatorsIndex]?.run).toContain('npm run lint')