ci: harden the fusermount3 repair (#10485)

* ci: move the fusermount3 repair into a composite action

Three copies of the same block were already drifting apart, and the
target comes from PATH: only ever add setuid root to a root-owned,
non-symlink binary under the system bin paths, and say why otherwise.

* test: say that the process exited in the wait errors

"process exit status 1 before ... accepted connections" is missing its
verb. Also mark the SIGTERM return discarded - it fails with
os.ErrProcessDone exactly when the select below already handles it.

* ci: prefer the distro fusermount3 over escalating a shadow copy

The shadowing /usr/local/bin/fusermount3 is not root-owned either, so
setting its setuid bit would have handed root to a binary the runner
user owns - the repair now symlinks the distro one earlier in PATH and
touches nothing, keeping the in-place chmod for a root-owned binary with
no distro alternative. A setuid bit only grants root when root owns the
file, so accept an existing one only then.

* ci: run the FUSE workflows when the shared action changes

Their paths filters listed each workflow file but not the composite
action all three now call.

.github/workflows/fuse-dlm-integration.yml

@@ -8,6 +8,7 @@ on:
       - 'weed/cluster/**'
       - 'test/fuse_dlm/**'
       - '.github/workflows/fuse-dlm-integration.yml'
+      - '.github/actions/fix-fusermount-setuid/**'
   push:
     branches: [master]
     paths:
@@ -15,6 +16,7 @@ on:
       - 'weed/mount/**'
       - 'weed/cluster/**'
       - 'test/fuse_dlm/**'
+      - '.github/actions/fix-fusermount-setuid/**'
 
 concurrency:
   group: ${{ github.head_ref || github.ref }}/fuse-dlm-integration
@@ -44,18 +46,9 @@ jobs:
           sudo apt-get install -y libfuse3-dev
           echo 'user_allow_other' | sudo tee -a /etc/fuse.conf
           sudo chmod 644 /etc/fuse.conf
-          # Some runner images carry a second, source-built fusermount3 in
-          # /usr/local/bin that shadows the distro one in PATH without its setuid
-          # bit, and every unprivileged mount then fails with EPERM. go-fuse takes
-          # the first fusermount3 in PATH, so repair that one.
-          fusermount_bin=$(command -v fusermount3 || true)
-          if [ -n "$fusermount_bin" ]; then
-            if [ ! -u "$fusermount_bin" ]; then
-              sudo chown root:root "$fusermount_bin"
-              sudo chmod u+s "$fusermount_bin"
-            fi
-            ls -l "$fusermount_bin"
-          fi
+
+      - name: Repair the fusermount3 setuid bit
+        uses: ./.github/actions/fix-fusermount-setuid
 
       - name: Build SeaweedFS
         run: go build -o weed/weed -buildvcs=false ./weed

.github/workflows/fuse-integration.yml

@@ -7,12 +7,14 @@ on:
       - 'weed/**'
       - 'test/fuse_integration/**'
       - '.github/workflows/fuse-integration.yml'
+      - '.github/actions/fix-fusermount-setuid/**'
   pull_request:
     branches: [ master, main ]
     paths:
       - 'weed/**'
       - 'test/fuse_integration/**'
       - '.github/workflows/fuse-integration.yml'
+      - '.github/actions/fix-fusermount-setuid/**'
 
 concurrency:
   group: ${{ github.head_ref }}/fuse-integration
@@ -45,22 +47,13 @@ jobs:
         # Allow non-root FUSE mounts with allow_other
         echo 'user_allow_other' | sudo tee -a /etc/fuse.conf
         sudo chmod 644 /etc/fuse.conf
-        # Some runner images carry a second, source-built fusermount3 in
-        # /usr/local/bin that shadows the distro one in PATH without its setuid
-        # bit, and every unprivileged mount then fails with EPERM. go-fuse takes
-        # the first fusermount3 in PATH, so repair that one.
-        fusermount_bin=$(command -v fusermount3 || true)
-        if [ -n "$fusermount_bin" ]; then
-          if [ ! -u "$fusermount_bin" ]; then
-            sudo chown root:root "$fusermount_bin"
-            sudo chmod u+s "$fusermount_bin"
-          fi
-          ls -l "$fusermount_bin"
-        fi
         # Verify FUSE installation
         fusermount3 --version || fusermount --version || true
         ls -la /dev/fuse
 
+    - name: Repair the fusermount3 setuid bit
+      uses: ./.github/actions/fix-fusermount-setuid
+
     - name: Build SeaweedFS
       run: |
         cd weed

.github/workflows/fuse-p2p-integration.yml

@@ -11,6 +11,7 @@ on:
       - 'weed/pb/filer.proto'
       - 'test/fuse_p2p/**'
       - '.github/workflows/fuse-p2p-integration.yml'
+      - '.github/actions/fix-fusermount-setuid/**'
   push:
     branches: [master]
     paths:
@@ -21,6 +22,7 @@ on:
       - 'weed/pb/mount_peer.proto'
       - 'weed/pb/filer.proto'
       - 'test/fuse_p2p/**'
+      - '.github/actions/fix-fusermount-setuid/**'
 
 concurrency:
   group: ${{ github.head_ref || github.ref }}/fuse-p2p-integration
@@ -50,18 +52,9 @@ jobs:
           sudo apt-get install -y libfuse3-dev
           echo 'user_allow_other' | sudo tee -a /etc/fuse.conf
           sudo chmod 644 /etc/fuse.conf
-          # Some runner images carry a second, source-built fusermount3 in
-          # /usr/local/bin that shadows the distro one in PATH without its setuid
-          # bit, and every unprivileged mount then fails with EPERM. go-fuse takes
-          # the first fusermount3 in PATH, so repair that one.
-          fusermount_bin=$(command -v fusermount3 || true)
-          if [ -n "$fusermount_bin" ]; then
-            if [ ! -u "$fusermount_bin" ]; then
-              sudo chown root:root "$fusermount_bin"
-              sudo chmod u+s "$fusermount_bin"
-            fi
-            ls -l "$fusermount_bin"
-          fi
+
+      - name: Repair the fusermount3 setuid bit
+        uses: ./.github/actions/fix-fusermount-setuid
 
       - name: Build SeaweedFS
         run: go build -o weed/weed -buildvcs=false ./weed