fix: cleanup EPERM and shrink oversized step summary in post.js

The events file is written via `sudo tee` so it ends up root-owned,
and /tmp's sticky bit blocks the unprivileged post-step from unlinking
it directly — swap fs.unlinkSync for `sudo rm -f`, matching how we
already write/signal via sudo elsewhere in this file.

The step summary was also one markdown row per raw event, which blew
past GitHub's 1MB limit on noisy runs with lots of repeated short-lived
connections. Now it's one row per distinct connection (grouped by
proto/ips/port/domain/process/uid) with a Count, a condensed source
port list, and a first/last seen time range — keeps process attribution
intact while cutting row count dramatically, with a size-based
truncation fallback just in case.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Author: tsigouris007

src/post.js

@@ -150,15 +150,68 @@ function parseEventsNDJSON(filePath) {
   }
 }
 
+// Collapse events into one row per distinct connection (same protocol,
+// source/destination IP, destination port+domain, process, UID) — repeated
+// connections (e.g. keep-alive requests with a new ephemeral source port each
+// time) differ only in timestamp/source port, which is what's aggregated here.
+// Process/UID are kept as grouping keys (not collapsed) since which process
+// made a connection is the signal this tracker exists to surface.
+// Returns groups sorted by count descending.
+function groupEvents(events) {
+  const groups = new Map();
+  for (const e of events) {
+    const protocol   = e.network?.protocol   || 'N/A';
+    const sourceIp   = e.source?.ip          || 'N/A';
+    const destIp     = e.destination?.ip     || 'N/A';
+    const destPort   = e.destination?.port   ?? 'N/A';
+    const destDomain = e.destination?.domain || 'N/A';
+    const proc       = e.process?.name       || 'N/A';
+    const uid        = e.user?.id            || 'N/A';
+    const key = [protocol, sourceIp, destIp, destPort, destDomain, proc, uid].join(' ');
+
+    let g = groups.get(key);
+    if (!g) {
+      g = {
+        protocol, sourceIp, destIp, destPort, destDomain, process: proc, uid,
+        count: 0, srcPorts: new Set(), firstSeen: null, lastSeen: null,
+      };
+      groups.set(key, g);
+    }
+    g.count += 1;
+    if (e.source?.port !== undefined && e.source?.port !== null) g.srcPorts.add(e.source.port);
+    const ts = e.timestamp;
+    if (ts) {
+      if (g.firstSeen === null || ts < g.firstSeen) g.firstSeen = ts;
+      if (g.lastSeen === null || ts > g.lastSeen) g.lastSeen = ts;
+    }
+  }
+  return [...groups.values()].sort((a, b) => b.count - a.count);
+}
+
+// Exact ports for low-cardinality groups; a count for the rest, so the cell
+// never becomes an unreadable pile of unrelated ephemeral port numbers.
+function formatSrcPorts(srcPorts) {
+  if (srcPorts.size === 0) return 'N/A';
+  if (srcPorts.size <= 3) return [...srcPorts].sort((a, b) => a - b).join(', ');
+  return `${srcPorts.size} distinct`;
+}
+
+// Leaves headroom under GitHub's 1024 KiB step-summary hard limit.
+const STEP_SUMMARY_BUDGET_BYTES = 900 * 1024;
+
 // Write a markdown summary table to GITHUB_STEP_SUMMARY.
-function printStepSummary(events) {
+// `fullDataLocation` (an S3 URI or "the job log") is referenced if the table
+// still has to be cut down to fit the size limit.
+function printStepSummary(events, fullDataLocation) {
   const summaryPath = process.env.GITHUB_STEP_SUMMARY;
   if (!summaryPath) return;
 
   const repo     = process.env.GITHUB_REPOSITORY || 'N/A';
   const workflow = process.env.GITHUB_WORKFLOW   || 'N/A';
   const runId    = process.env.GITHUB_RUN_ID     || 'N/A';
 
+  const groups = groupEvents(events);
+
   // Aggregate stats.
   const uniqueDsts = new Set(events.map((e) => e.destination?.ip)).size;
   const byProto = {};
@@ -178,44 +231,59 @@ function printStepSummary(events) {
     '| Repository | Workflow | Run ID |\n' +
     '| --- | --- | --- |\n' +
     `| ${repo} | ${workflow} | ${runId} |\n\n` +
-    '| Total Events | Unique Destination IPs | Protocols |\n' +
-    '| --- | --- | --- |\n' +
-    `| ${events.length} | ${uniqueDsts} | ${protoLine} |\n\n` +
+    '| Total Events | Unique Connections | Unique Destination IPs | Protocols |\n' +
+    '| --- | --- | --- | --- |\n' +
+    `| ${events.length} | ${groups.length} | ${uniqueDsts} | ${protoLine} |\n\n` +
     '---\n\n';
 
-  // Connection table.
+  // Connection table: one row per distinct connection, not per raw event.
   const columns = [
-    'Timestamp', 'Protocol',
-    'Source IP', 'Src Port',
-    'Destination IP', 'Dst Port', 'Dst Domain',
-    'PID', 'Process', 'UID',
+    'Protocol', 'Source IP', 'Destination IP', 'Dst Port', 'Dst Domain',
+    'Process', 'UID', 'Count', 'Src Ports', 'First Seen (UTC)', 'Last Seen (UTC)',
   ];
-
-  const mdRows = [];
-  mdRows.push(`| ${columns.join(' | ')} |`);
-  mdRows.push(`| ${columns.map(() => '---').join(' | ')} |`);
-
-  for (const e of events) {
+  const headerLines = [
+    `| ${columns.join(' | ')} |`,
+    `| ${columns.map(() => '---').join(' | ')} |`,
+  ];
+  const rowLines = groups.map((g) => {
     const row = [
-      e.timestamp                  || 'N/A',
-      e.network?.protocol          || 'N/A',
-      e.source?.ip                 || 'N/A',
-      e.source?.port               ?? 'N/A',
-      e.destination?.ip            || 'N/A',
-      e.destination?.port          ?? 'N/A',
-      e.destination?.domain        || 'N/A',
-      e.process?.pid               ?? 'N/A',
-      e.process?.name              || 'N/A',
-      e.user?.id                   || 'N/A',
+      g.protocol, g.sourceIp, g.destIp, g.destPort, g.destDomain,
+      g.process, g.uid, g.count, formatSrcPorts(g.srcPorts),
+      g.firstSeen || 'N/A', g.lastSeen || 'N/A',
     ];
-    mdRows.push(`| ${row.join(' | ')} |`);
+    return `| ${row.join(' | ')} |`;
+  });
+
+  const sectionHeader = '## Network Events\n\n';
+  const footer = '\n\n---\n';
+
+  // Safety net: only trims in genuinely high-cardinality cases (e.g. many
+  // one-off unique destinations), since grouping already collapses repeats.
+  const fixedBytes = Buffer.byteLength(
+    metadataMd + sectionHeader + headerLines.join('\n') + '\n' + footer, 'utf8',
+  );
+  const budgetForRows = STEP_SUMMARY_BUDGET_BYTES - fixedBytes;
+
+  let usedBytes = 0;
+  const includedRows = [];
+  for (const line of rowLines) {
+    const lineBytes = Buffer.byteLength(line + '\n', 'utf8');
+    if (usedBytes + lineBytes > budgetForRows) break;
+    includedRows.push(line);
+    usedBytes += lineBytes;
   }
 
+  const omittedCount = rowLines.length - includedRows.length;
+  const truncationNote = omittedCount > 0
+    ? `\n> ${omittedCount} of ${rowLines.length} connections omitted to stay under the step summary size limit — full data is in ${fullDataLocation}.\n`
+    : '';
+
   try {
     fs.appendFileSync(summaryPath, metadataMd);
-    fs.appendFileSync(summaryPath, '## Network Events\n\n');
-    fs.appendFileSync(summaryPath, mdRows.join('\n'));
-    fs.appendFileSync(summaryPath, '\n\n---\n');
+    fs.appendFileSync(summaryPath, sectionHeader);
+    fs.appendFileSync(summaryPath, [...headerLines, ...includedRows].join('\n'));
+    fs.appendFileSync(summaryPath, truncationNote);
+    fs.appendFileSync(summaryPath, footer);
   } catch (err) {
     core.warning(`Could not write step summary: ${err.message}`);
   }
@@ -307,7 +375,9 @@ async function run() {
     ], { env: buildS3UploadEnv() });
     core.info('Upload complete');
     try {
-      fs.unlinkSync(EVENTS_FILE);
+      // EVENTS_FILE is root-owned (written via `sudo tee`) and /tmp has the
+      // sticky bit set, so only root can unlink it
+      await exec.exec('sudo', ['rm', '-f', EVENTS_FILE]);
     } catch (cleanupErr) {
       core.warning(`Could not delete ${EVENTS_FILE}: ${cleanupErr.message}`);
     }