Fix service restarter test

.gitea/workflows/deploy.yml

@@ -34,6 +34,7 @@ jobs:
 
       - name: Check runner tools
         run: |
+          echo "running as $(id -un) on $(hostname)"
           command -v python3
           command -v rsync
           command -v curl
@@ -43,8 +44,25 @@ jobs:
           test -d "$DEPLOY_PATH"
           test -w "$DEPLOY_PATH"
 
+      # `sudo -n -l <cmd>` asks "may I run this?" without prompting, so the
+      # job stops here with the line to add rather than deploying and then
+      # falling over on the restart at the very end.
       - name: Check the restart is allowed without a password
-        run: sudo -n systemctl is-active "$SERVICE" || true
+        run: |
+          SYSTEMCTL="$(command -v systemctl)"
+          if sudo -n -l "$SYSTEMCTL" restart "$SERVICE" >/dev/null 2>&1; then
+            echo "$(id -un) may restart $SERVICE"
+            exit 0
+          fi
+          echo "$(id -un) cannot restart $SERVICE without a password. Once, here:"
+          echo
+          echo "  echo '$(id -un) ALL=(ALL) NOPASSWD: $SYSTEMCTL restart $SERVICE' \\"
+          echo "    | sudo tee /etc/sudoers.d/$SERVICE"
+          echo "  sudo chmod 440 /etc/sudoers.d/$SERVICE"
+          echo
+          echo "The path matters: sudo matches what it resolves from PATH"
+          echo "against the sudoers line, without following symlinks."
+          exit 1
 
       # A throwaway virtualenv in the workspace -- this is the npm ci of a
       # Python project. The one under $DEPLOY_PATH/.venv is what the running
@@ -80,8 +98,10 @@ jobs:
           test -d "$DEPLOY_PATH/.venv" || python3 -m venv "$DEPLOY_PATH/.venv"
           "$DEPLOY_PATH/.venv/bin/pip" install --quiet -r "$DEPLOY_PATH/requirements.txt"
 
+      # The same absolute path the check above validated, so PATH order
+      # cannot leave sudo matching a different one (/bin vs /usr/bin).
       - name: Restart
-        run: sudo systemctl restart "$SERVICE"
+        run: sudo -n "$(command -v systemctl)" restart "$SERVICE"
 
       - name: Wait for the panel to answer
         run: |
@@ -95,5 +115,5 @@ jobs:
             sleep 1
           done
           echo "panel did not come back -- last of its log:"
-          sudo systemctl status "$SERVICE" --no-pager --lines 30 || true
+          systemctl status "$SERVICE" --no-pager --lines 30 || true
           exit 1