Merge branch 'main' into FIX-COS-3682

Author: yasminvalim

.gemini/config.yaml

@@ -3,10 +3,11 @@
 have_fun: true
 code_review:
   disable: false
-  comment_severity_threshold: MEDIUM
+  comment_severity_threshold: "MEDIUM"
   max_review_comments: -1
   pull_request_opened:
     help: false
-    summary: false # turned off by default
+    # Turned off by default
+    summary: false
     code_review: true
 ignore_patterns: []

.github/workflows/ci.yml

@@ -86,7 +86,10 @@ jobs:
           root_part=$(sudo sfdisk -l -J "${device}" | jq -r '.partitiontable.partitions[] | select(.name == "root").node')
           sudo mount "${root_part}" /mnt/
           sudo ls /mnt/boot/grub2/grub.cfg
-          [ $(sudo stat -c "%a" /mnt/boot/grub2/grub.cfg) == "600" ]
+          for f in /mnt/boot/grub2/grub.cfg /mnt/boot/grub2/bootuuid.cfg /mnt/boot/grub2/grubenv; do
+            perm=$(sudo stat -c '%a' "$f") || exit 1
+            [ "$perm" == "600" ] || { echo "$f has permissions $perm (expected 600)"; exit 1; }
+          done
           sudo umount /mnt
           sudo losetup -D "${device}"
           sudo rm -f myimage.raw
@@ -102,7 +105,10 @@ jobs:
             --disable-selinux --replace=alongside /target
           # Verify we injected static configs
           jq -re '.["static-configs"].version' /boot/bootupd-state.json
-          [ $(sudo stat -c "%a" /boot/grub2/grub.cfg) == "600" ]
+          for f in /boot/grub2/grub.cfg /boot/grub2/bootuuid.cfg /boot/grub2/grubenv; do
+            perm=$(sudo stat -c '%a' "$f") || exit 1
+            [ "$perm" == "600" ] || { echo "$f has permissions $perm (expected 600)"; exit 1; }
+          done
 
       - name: bootupctl generate-update-metadata
         run: |