[code-quality] Report missing command errors

[Pedro Henrique Penna (ppenna)]

Summary

common.run_checked and common.run_capture are the shared subprocess helpers of the build, CI, source-collection, and packaging commands. When a command cannot start (its executable is missing or not executable, or its working directory does not exist), subprocess.run raises OSError. That error escaped both helpers instead of becoming the repository-standard ScriptError, and its text alone does not identify the command. For example, nvx.py reported a missing git during materialize-kernel-provenance-inputs as:

error: [Errno 2] No such file or directory: 'git'                 (Linux)
error: [WinError 2] The system cannot find the file specified     (Windows)

Both helpers now raise a ScriptError that names the full command and the OS error, with the OSError chained as its cause:

error: failed to run command git ls-tree -r -z --name-only HEAD -- kernel/config-microvm kernel/patches: [WinError 2] The system cannot find the file specified

A command that starts is reported as before, whatever its exit status. A regression test runs both helpers on a missing executable and checks the message and the chained FileNotFoundError. Without the common.py change, the test fails for both helpers.

This is a novel candidate: recent code-quality PRs #361, #343, and #310 addressed managed-exec manifests, Alpine package manifests, and benchmark float validation respectively; active PRs #362 and #365 concern package-lock hashing and path-existence reuse, not process-start errors. No tracked issue or active PR covers this shared command boundary.

Scope

Changed files:

• scripts/nvx_tools/common.py
• scripts/test_nvx_tools.py

Total changed lines: 29 added, 6 deleted. No dependency, public API/CLI/ABI, gitlink, or OpenVMM change was made.

Validation

All runs used 7e9997c on dev at d68859d.

Local (Windows):

• python -m unittest scripts.test_nvx_tools.SharedCommandTests -v: passed.
• The Windows validate-nvx command set (compileall, the nine unittest suites with 741 tests, test_adversarial.py, test_hosts.py, and the CLI --help checks): passed. test_windows_curl_shim_retries_http_500 needs rustc on PATH; it passed once a toolchain was provided.
• ruff check, ruff format --check, pyright --pythonplatform Linux, pyright --pythonplatform Windows, and git diff --check: passed.

Remote runners: each used an isolated depth-1 checkout that mirrors CI (NVX d68859d plus the bundled 7e9997c, OpenVMM a41cf73). The checkouts were removed afterwards.

Runner	Platform	validate-nvx	nvx.py verify	Missing git (before → after)
azure-kvm-1	linux-kvm	741 tests OK (9 skipped); adversarial 70 OK; hosts 4 OK; --help OK	passed	[Errno 2] No such file or directory: 'git' → failed to run command git ls-tree … : [Errno 2] …
azure-azlinux-1	linux-mshv	741 tests OK (9 skipped); adversarial 70 OK; hosts 4 OK; --help OK	passed	same as azure-kvm-1
azure-windows-1	windows-whp	741 tests OK (86 skipped); adversarial 70 OK (6 skipped); hosts 4 OK; --help OK	passed	[WinError 2] The system cannot find the file specified → failed to run command git ls-tree … : [WinError 2] …

On each runner, both helpers were also run against real processes:

• A missing executable, a nonexistent working directory, and, on Linux, a non-executable file now raise ScriptError, with the OSError subclass as the cause.
• A successful command, a nonzero exit (command failed with exit 3: …), and run_capture returning status 3 behave as before.
• With git available, materialize-kernel-provenance-inputs succeeds.

Generated by code-quality · copilot · gpt56 · 5.31 AIC · ⌖ 0.861 AIC · ⊞ 17.8K · ◷

• expires on Oct 19, 2026, 10:27 PM UTC

[Copilot]

Copilot review overview

🟢 Approval recommended

The focused change preserves existing command-exit handling and adds regression coverage, with no identified blocking issues.

Review effort: Balanced
Findings: None

What changed in this PR

Makes subprocess startup failures use the repository-standard ScriptError instead of exposing raw OSError tracebacks.

Changes:

• Translates startup errors while preserving the original exception as the cause.
• Adds a regression test for a missing executable.

File	Description
scripts/​test_nvx_tools.py	Tests missing-executable error reporting.
scripts/​nvx_tools/​common.py	Wraps subprocess startup errors in ScriptError.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Copilot review overview

🟢 Approval recommended

The focused change preserves existing exit-status behavior and covers both helpers with a regression test.

Review effort: Balanced
Findings: None

[Copilot]

🟢 Approval recommended

The focused changes preserve existing exit-status behavior, include regression coverage, and have no identified blocking issues.

0 open findings

🧠 Review effort: Balanced

---

Give feedback about Copilot approvals in this survey to enter a drawing for a $150 gift card.

[Copilot]

🟢 Approval recommended

The focused change preserves completed-command behavior, includes regression coverage, and has no identified blocking issues.

0 open findings

🧠 Review effort: Balanced

---

Give feedback about Copilot approvals in this survey to enter a drawing for a $150 gift card.