fix: support isolated CI paper rendering

Author: futhr

.github/workflows/documentation.yml

@@ -30,6 +30,9 @@ jobs:
       - name: Install the pinned browser renderer
         run: cargo xtask browser-install
       - name: Compile and validate the site and technical manuscript
+        env:
+          # The disposable hosted runner cannot use Chrome's Linux namespace sandbox.
+          NUIF_CHROME_NO_SANDBOX: "1"
         run: cargo xtask docs-paper
       - name: Retain the compiled site and validation report
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1

docs/PUBLISHING.md

@@ -25,6 +25,11 @@ mdBook server. `docs-paper` builds the site and prints the generated technical
 manuscript to `target/docs-site/downloads/nuif-research-manuscript.pdf` through
 the repository's pinned Chrome for Testing binary.
 
+`docs-paper` keeps Chrome's process sandbox enabled by default. A disposable,
+externally isolated CI runner that cannot create Chrome's Linux namespace may
+set `NUIF_CHROME_NO_SANDBOX=1`; do not use that override for routine local
+rendering.
+
 The pinned renderer can be installed through:
 
 ```sh

xtask/src/documentation.rs

@@ -192,16 +192,30 @@ pub(crate) fn paper() -> Result<(), String> {
         "--print-to-pdf={}",
         absolute_path(output)?.to_string_lossy()
     );
-    let status = Command::new(chrome_for_testing()?)
-        .args([
-            "--headless=new",
-            "--disable-gpu",
-            "--disable-dev-shm-usage",
-            "--hide-scrollbars",
-            "--no-pdf-header-footer",
-            output_argument.as_str(),
-            source_url.as_str(),
-        ])
+    let mut command = Command::new(chrome_for_testing()?);
+    command.args([
+        "--headless=new",
+        "--disable-gpu",
+        "--disable-dev-shm-usage",
+        "--hide-scrollbars",
+        "--no-pdf-header-footer",
+    ]);
+    match std::env::var("NUIF_CHROME_NO_SANDBOX") {
+        Ok(value) if value == "1" => {
+            command.arg("--no-sandbox");
+        }
+        Ok(value) => {
+            return Err(format!(
+                "NUIF_CHROME_NO_SANDBOX must be 1 when set, got {value:?}"
+            ));
+        }
+        Err(std::env::VarError::NotPresent) => {}
+        Err(std::env::VarError::NotUnicode(_)) => {
+            return Err("NUIF_CHROME_NO_SANDBOX must be valid UTF-8".to_owned());
+        }
+    }
+    let status = command
+        .args([output_argument.as_str(), source_url.as_str()])
         .status()
         .map_err(|error| format!("could not start Chrome for Testing: {error}"))?;
     if !status.success() {