workflow: exclude chack temp artifacts from sanitized master-fix patch

This reverts commit 1e6c83f43b.

.github/workflows/PR-tests.yml

@@ -161,11 +161,9 @@ jobs:
         run: linPEAS/linpeas_fat.sh -o software_information -a
       
       - name: Run linpeas interesting_perms_files
-        if: ${{ false }}
         run: linPEAS/linpeas_fat.sh -o interesting_perms_files -a
       
       - name: Run linpeas interesting_files
-        if: ${{ false }}
         run: linPEAS/linpeas_fat.sh -o interesting_files -a
 
   Build_and_test_macpeas_pr:
@@ -209,5 +207,4 @@ jobs:
         run: linPEAS/linpeas_fat.sh -o users_information -a
       
       - name: Run macpeas software_information
-        if: ${{ false }}
         run: linPEAS/linpeas_fat.sh -o software_information -a

.github/workflows/ci-master-failure-chack-agent-pr.yml

@@ -126,37 +126,72 @@ jobs:
 
       - name: Commit and push fix branch if changed
         id: push_fix
+        env:
+          ORIGINAL_HEAD_SHA: ${{ github.event.workflow_run.head_sha }}
         run: |
-          if git diff --quiet; then
-            echo "No changes to commit."
+          rm -f chack_failure_summary.txt chack_prompt.txt chack_failed_steps_logs.txt
+
+          pushed=false
+
+          if ! git diff --quiet; then
+            git add -A
+            # Avoid workflow-file pushes with token scopes that cannot write workflows.
+            git reset -- .github/workflows || true
+            git checkout -- .github/workflows || true
+            git clean -fdx -- .github/workflows || true
+            git reset -- chack_failure_summary.txt chack_prompt.txt chack_failed_steps_logs.txt
+            if git diff --cached --name-only | grep -q '^.github/workflows/'; then
+              echo "Workflow-file changes are still staged; skipping push without workflows permission."
+              echo "pushed=false" >> "$GITHUB_OUTPUT"
+              exit 0
+            fi
+            if ! git diff --cached --quiet; then
+              git commit -m "Fix CI-master failures for run #${{ github.event.workflow_run.id }}"
+            fi
+          fi
+
+          after_head="$(git rev-parse HEAD)"
+          if [ "$after_head" = "$ORIGINAL_HEAD_SHA" ]; then
+            echo "No commit produced by Chack Agent."
             echo "pushed=false" >> "$GITHUB_OUTPUT"
             exit 0
           fi
 
-          rm -f chack_failure_summary.txt chack_prompt.txt chack_failed_steps_logs.txt
-          git add -A
-          # Avoid workflow-file pushes with token scopes that cannot write workflows.
-          git reset -- .github/workflows || true
-          git checkout -- .github/workflows || true
-          git clean -fdx -- .github/workflows || true
-          git reset -- chack_failure_summary.txt chack_prompt.txt chack_failed_steps_logs.txt
-          if git diff --cached --name-only | grep -q '^.github/workflows/'; then
-            echo "Workflow-file changes are still staged; skipping push without workflows permission."
+          echo "Sanitizing Chack commit range to non-workflow changes only."
+          git diff --binary "$ORIGINAL_HEAD_SHA"..HEAD -- \
+            . \
+            ':(exclude).github/workflows/**' \
+            ':(exclude)chack_failure_summary.txt' \
+            ':(exclude)chack_prompt.txt' \
+            ':(exclude)chack_failed_steps_logs.txt' > /tmp/chack_nonworkflow.patch
+          if [ ! -s /tmp/chack_nonworkflow.patch ]; then
+            echo "Only workflow-file changes were produced; skipping push."
             echo "pushed=false" >> "$GITHUB_OUTPUT"
             exit 0
           fi
+          git reset --hard "$ORIGINAL_HEAD_SHA"
+          git apply --index /tmp/chack_nonworkflow.patch
+          rm -f chack_failure_summary.txt chack_prompt.txt chack_failed_steps_logs.txt
+          git reset -- chack_failure_summary.txt chack_prompt.txt chack_failed_steps_logs.txt || true
           if git diff --cached --quiet; then
-            echo "No committable changes left after filtering."
+            echo "No non-workflow changes left after sanitizing."
             echo "pushed=false" >> "$GITHUB_OUTPUT"
             exit 0
           fi
           git commit -m "Fix CI-master failures for run #${{ github.event.workflow_run.id }}"
+
           if ! git push origin HEAD:"$FIX_BRANCH"; then
             echo "Push failed (likely token workflow permission limits); skipping PR creation."
             echo "pushed=false" >> "$GITHUB_OUTPUT"
             exit 0
           fi
-          echo "pushed=true" >> "$GITHUB_OUTPUT"
+          pushed=true
+
+          if [ "$pushed" = "true" ]; then
+            echo "pushed=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "pushed=false" >> "$GITHUB_OUTPUT"
+          fi
 
       - name: Create PR to master
         if: ${{ steps.push_fix.outputs.pushed == 'true' }}
@@ -165,15 +200,34 @@ jobs:
           GH_TOKEN: ${{ secrets.CHACK_AGENT_FIXER_TOKEN || github.token }}
           RUN_URL: ${{ github.event.workflow_run.html_url }}
         run: |
-          pr_url=$(gh pr create \
+          set +e
+          pr_output=$(gh pr create \
             --title "Fix CI-master_test failure (run #${{ github.event.workflow_run.id }})" \
             --body "Automated Chack Agent fix for failing CI-master_test run: ${RUN_URL}" \
             --base "$TARGET_BRANCH" \
-            --head "$FIX_BRANCH")
-          echo "url=$pr_url" >> "$GITHUB_OUTPUT"
+            --head "$FIX_BRANCH" 2>&1)
+          rc=$?
+          set -e
+
+          if [ $rc -eq 0 ]; then
+            echo "url=$pr_output" >> "$GITHUB_OUTPUT"
+            echo "created=true" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          echo "$pr_output"
+          if echo "$pr_output" | grep -qi "not permitted to create or approve pull requests"; then
+            echo "PR creation blocked by repository Actions policy. Fix branch was pushed: $FIX_BRANCH"
+            echo "url=" >> "$GITHUB_OUTPUT"
+            echo "created=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          echo "Unexpected PR creation error."
+          exit $rc
 
       - name: Comment on created PR with Chack Agent result
-        if: ${{ steps.push_fix.outputs.pushed == 'true' && steps.run_chack.outputs.final-message != '' }}
+        if: ${{ steps.push_fix.outputs.pushed == 'true' && steps.create_pr.outputs.created == 'true' && steps.run_chack.outputs.final-message != '' }}
         uses: actions/github-script@v7
         env:
           PR_URL: ${{ steps.create_pr.outputs.url }}

.github/workflows/pr-failure-chack-agent-dispatch.yml

@@ -199,33 +199,44 @@ jobs:
         env:
           TARGET_BRANCH: ${{ needs.resolve_pr_context.outputs.head_branch }}
           PR_NUMBER: ${{ needs.resolve_pr_context.outputs.number }}
+          ORIGINAL_HEAD_SHA: ${{ github.event.workflow_run.head_sha }}
           GH_TOKEN: ${{ github.token }}
         run: |
-          if git diff --quiet; then
-            echo "No changes to commit."
-            exit 0
-          fi
           rm -f chack_failure_summary.txt chack_prompt.txt
-          git add -A
-          # Avoid workflow-file pushes with token scopes that cannot write workflows.
-          git reset -- .github/workflows || true
-          git checkout -- .github/workflows || true
-          git clean -fdx -- .github/workflows || true
-          git reset -- chack_failure_summary.txt chack_prompt.txt
-          if git diff --cached --name-only | grep -q '^.github/workflows/'; then
-            echo "Workflow-file changes are still staged; skipping push without workflows permission."
+
+          pushed=false
+
+          if ! git diff --quiet; then
+            git add -A
+            # Avoid workflow-file pushes with token scopes that cannot write workflows.
+            git reset -- .github/workflows || true
+            git checkout -- .github/workflows || true
+            git clean -fdx -- .github/workflows || true
+            git reset -- chack_failure_summary.txt chack_prompt.txt
+            if git diff --cached --name-only | grep -q '^.github/workflows/'; then
+              echo "Workflow-file changes are still staged; skipping push without workflows permission."
+              exit 0
+            fi
+            if ! git diff --cached --quiet; then
+              git commit -m "Fix CI failures for PR #${PR_NUMBER}"
+            fi
+          fi
+
+          after_head="$(git rev-parse HEAD)"
+          if [ "$after_head" = "$ORIGINAL_HEAD_SHA" ]; then
+            echo "No commit produced by Chack Agent for PR #${PR_NUMBER}."
             exit 0
           fi
-          if git diff --cached --quiet; then
-            echo "No committable changes left after filtering."
-            exit 0
-          fi
-          git commit -m "Fix CI failures for PR #${PR_NUMBER}"
+
           if ! git push origin HEAD:${TARGET_BRANCH}; then
             echo "Push failed (likely token workflow permission limits); leaving run successful without push."
             exit 0
           fi
-          gh workflow run PR-tests.yml --ref "${TARGET_BRANCH}"
+          pushed=true
+
+          if [ "$pushed" = "true" ]; then
+            gh workflow run PR-tests.yml --ref "${TARGET_BRANCH}"
+          fi
 
       - name: Comment with Chack Agent result
         if: ${{ steps.run_chack.outputs.final-message != '' }}

linPEAS/builder/linpeas_builder.py

@@ -51,5 +51,5 @@ if __name__ == "__main__":
         print("You must specify one of the following options: --all, --all-no-fat, --small or --include")
         parser.print_help()
         exit(1)
-
+    
     main(all_modules, all_no_fat_modules, no_network_scanning, small, include_modules, exclude_modules, output)

linPEAS/builder/linpeas_parts/6_users_information/16_Subuid_subgid_mappings.sh

@@ -1,36 +0,0 @@
-# Title: Users Information - subuid/subgid mappings
-# ID: UG_Subuid_subgid_mappings
-# Author: Carlos Polop
-# Last Update: 13-02-2026
-# Description: Show delegated user namespace ID ranges from /etc/subuid and /etc/subgid.
-# License: GNU GPL
-# Version: 1.0
-# Functions Used: print_2title
-# Global Variables: $MACPEAS
-# Initial Functions:
-# Generated Global Variables:
-# Fat linpeas: 0
-# Small linpeas: 1
-
-
-print_2title "User namespace mappings (subuid/subgid)"
-if [ "$MACPEAS" ]; then
-  echo "Not applicable on macOS"
-else
-  if [ -r /etc/subuid ]; then
-    echo "subuid:"
-    grep -v -E '^\s*#|^\s*$' /etc/subuid 2>/dev/null
-  else
-    echo "/etc/subuid not readable or not present"
-  fi
-
-  if [ -r /etc/subgid ]; then
-    echo ""
-    echo "subgid:"
-    grep -v -E '^\s*#|^\s*$' /etc/subgid 2>/dev/null
-  else
-    echo "/etc/subgid not readable or not present"
-  fi
-fi
-echo ""
-

linPEAS/builder/src/linpeasBuilder.py

@@ -46,7 +46,7 @@ class LinpeasBuilder:
 
     def build(self):
         print("[+] Building variables...")
-        variables = self.__generate_variables()
+        variables = self.__generate_variabless()
         self.__replace_mark(PEAS_VARIABLES_MARKUP, variables, "")
         
         if len(re.findall(r"PSTORAGE_[a-zA-Z0-9_]+", self.linpeas_sh)) > 1: #Only add storages if there are storages (PSTORAGE_BACKUPS is always there so it doesn't count)