Run update-ca-certificates as root

[JamieMagee]

This is equivalent to dependabot/cli#466

Required by dependabot/dependabot-core#9627

[Copilot]

Pull Request Overview

This PR ensures update-ca-certificates runs as root before executing Dependabot commands under the dependabot user in the updater container, and fixes a test directory creation call.

• Split command execution into root vs. non-root phases in the container service
• Updated UpdaterBuilder to launch the container as dependabot with an interactive shell
• Added { recursive: true } to fs.mkdirSync in the integration test

Reviewed Changes

Copilot reviewed 3 out of 9 changed files in this pull request and generated 1 comment.

File	Description
src/updater-builder.ts	Set container User to dependabot and override Cmd/Tty flags
src/container-service.ts	Introduce execCommand helper, run CA update as root, then user
tests/updater-builder-integration.test.ts	Add recursive flag to mkdirSync to avoid missing parent folders

Comments suppressed due to low confidence (2)

tests/updater-builder-integration.test.ts:44

• The new root-phase update-ca-certificates logic in ContainerService.run isn’t covered by existing integration tests. Consider adding a test that verifies the CA certificates step succeeds when running as root.

    fs.mkdirSync(workingDirectory, {recursive: true})

src/updater-builder.ts:55

• Overriding the container command to just /bin/sh without -c or a no-op entrypoint leaves the shell open and may prevent the intended workflow. Consider specifying a simple no-op (e.g., ['/bin/sh', '-c', 'while true; do sleep 1; done']) or removing the Cmd override to use the image’s default entrypoint.

      Cmd: ['/bin/sh'],

[Copilot]

In the dependabot branch, the container process (an interactive shell) is never stopped or waited on before removal, which can lead to resource leaks or hanging. Add an explicit container.stop() or a final container.wait() in the dependabot path once all execCommand calls complete.

Suggested change

	}
	}
	// Stop the container after all commands are executed
	await container.stop()

[JamieMagee]

Not sure why the difference in dist check is failing. I am running npm run clean-install and npm run package.

EDIT: I'm running Node 24 locally, and GitHub Actions is running Node 20. For some reason these were giving different results.

[jpinz]

lgtm