fix: Preserve individual environment variables with sudo

[HomayoonAlimohammadi]

Overview

sudo-rs ignores -E and requires individual environment variables to be preserved.

Fixes: #5266
Fixes: #5280
Fixes: #5302
Fixes: #5282
Fixes: #5283

[HomayoonAlimohammadi]

The failing lint is being addressed in fe213a0 of this PR: #5318

[berkayoz]

LGTM, we should be replicating the previous behavior now. We can revisit to limit the environment variables passed through later on.

[Copilot]

Pull request overview

This pull request addresses compatibility issues with sudo-rs, an alternative sudo implementation, by modifying how environment variables are preserved when executing commands with elevated privileges. The changes replace the use of sudo -E (which sudo-rs ignores) with sudo --preserve-env that explicitly lists individual environment variables.

Key changes:

• Introduced list_env_vars() function to generate a comma-separated list of all current environment variables
• Modified run_with_sudo() to use --preserve-env with explicit variable list instead of -E flag
• Updated scripts/inspect.sh to use run_with_sudo wrapper instead of direct sudo -E calls

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.

File	Description
microk8s-resources/actions/common/utils.sh	Added list_env_vars() helper function and updated run_with_sudo() to use --preserve-env with explicit environment variable list for sudo-rs compatibility
scripts/inspect.sh	Replaced direct sudo -E calls with run_with_sudo wrapper function for consistent environment variable handling

Comments suppressed due to low confidence (2)

microk8s-resources/actions/common/utils.sh:98

• [nitpick] The preserve_env parameter is accepted and consumed (via shift) but doesn't affect the function's behavior. The function always preserves environment variables when not in strict mode, regardless of whether this parameter is passed. This parameter appears to be vestigial or intended for documentation purposes only, which can be confusing to maintainers. Consider either implementing different behavior based on this parameter, or removing it and updating all call sites if it's not needed.

  if [ "$1" == "preserve_env" ]; then
    shift
  fi

microk8s-resources/actions/common/utils.sh:93

• The list_env_vars() function preserves ALL environment variables indiscriminately, which poses a security risk. Sensitive environment variables (such as tokens, credentials, or API keys) should not be passed through sudo. Additionally, environment variable names containing special characters (e.g., BASH_FUNC_*) or newlines could break the comma-separated list format or cause issues with sudo's --preserve-env option. Consider creating a whitelist of specific environment variables that need to be preserved instead.

list_env_vars() {
  env | awk -F= '{print $1}' | paste -sd,
}

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.