[kurtmcdonald]

Summary

Container jobs that opt in with allow-inside-container: true typically run as root in an image without a sudo binary. Every privileged call in blacksmith-cache.ts was a hardcoded sudo ..., so the first one after the sticky disk was granted (blockdev --getsize64) threw Unable to locate executable file: sudo, the setup error was caught in git-source-provider.ts, and the job silently fell back to a plain checkout — losing the git mirror.

New helper, applied at all 11 call sites (blockdev, blkid, resize2fs, mkfs.ext4, mkdir, mount, chown, umount, blockdev --flushbufs):

function asRoot(cmd, args): string[] {
  return process.getuid?.() === 0 ? [cmd, ...args] : ['sudo', cmd, ...args]
}
execAsRoot(cmd, args)            // exec.exec(...asRoot(cmd, args))
getExecOutputAsRoot(cmd, args, o) // exec.getExecOutput(...asRoot(cmd, args), o)

The two timeout N sudo ... wrappers (umount, flushbufs) spread asRoot(...) into the timeout argv. Behavior on the runner VM (non-root) is unchanged.

Same pattern as proposed fix #1 on BLA-4661 (stickydisk action); this PR only covers checkout. dist/index.js rebuilt.

Link to Devin session: https://app.devin.ai/sessions/f43e6133d752489f9b3cf56906c10321
Open in Devin Desktop: https://app.devin.ai/desktop/session/f43e6133d752489f9b3cf56906c10321?variant=devin
Requested by: @kurtmcdonald

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring