Fix Linux CI tests: add --no-sandbox for subprocess launch

CEF's sandbox setup (user namespace or chrome-sandbox SETUID) fails on
GitHub Actions runners, causing execvp to fail for every subprocess type.
Add --no-sandbox to Linux test switches so CEF launches subprocesses
directly without sandbox scaffolding.

Also chmod +x cefpython3/subprocess in the test job as a safety measure
in case artifact transfer drops the execute bit.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: linesight

.github/workflows/ci-linux.yml

@@ -40,7 +40,9 @@ jobs:
         uses: actions/cache@v4
         if: ${{ inputs.bypass_cache != true }}
         with:
-          path: build/cef_binary_*
+          path: |
+            build/cef_binary_*
+            build/cef*_linux64
           key: cef-linux64-${{ steps.cef-version.outputs.value }}
 
       - name: Install system dependencies
@@ -120,7 +122,9 @@ jobs:
           path: build/artifacts/
 
       - name: Set up cefpython3 package for testing
-        run: cp -r build/artifacts/. cefpython3/
+        run: |
+          cp -r build/artifacts/. cefpython3/
+          chmod +x cefpython3/subprocess
 
       - name: Run unit tests
         run: xvfb-run python unittests/_test_runner.py

unittests/main_test.py

@@ -143,6 +143,10 @@ def test_main(self):
             settings["log_severity"] = cef.LOGSEVERITY_WARNING
         # Chrome 130+ blocks window.open() called without a user gesture.
         switches = {"disable-popup-blocking": ""}
+        if LINUX:
+            # Sandbox setup (user-namespace) fails on CI runners; GPU process
+            # also needs --no-sandbox to launch successfully under xvfb.
+            switches["no-sandbox"] = ""
         cef.Initialize(settings, switches=switches)
         subtest_message("cef.Initialize() ok")
 

unittests/osr_test.py

@@ -112,6 +112,10 @@ def test_osr(self):
             "enable-begin-frame-scheduling": "",
             "disable-surfaces": "",  # This is required for PDF ext to work
         }
+        if LINUX:
+            # Sandbox setup fails on CI runners; subprocess won't launch
+            # without this under xvfb even with --disable-gpu.
+            switches["no-sandbox"] = ""
         browser_settings = {
             # Tweaking OSR performance (Issue #240)
             "windowless_frame_rate": 30,  # Default frame rate in CEF is 30