Merge main into fix/1901-failure-contract: pin mesh-sdk a2759ec (the group's sdk head), the failure kit check's marker lists what it reads (issue 1936), and the registry test's password can no longer match a random workspace name (issue 1901)

modules/mesh-build-node/cmd/mesh-build-node/fetch_test.go

@@ -175,7 +175,7 @@ func TestAnotherNovoxPackageIsInstalledFromTheRegistryThroughAUserconfig(t *test
 	files["modules/m/package-lock.json"] = `{}`
 	m, f := fetchMachine(t, files, map[string]string{"@novox/other/index.js": "o", "lodash/index.js": "l"})
 	m.Toolchain.Registry = func() (Registry, error) {
-		return Registry{URL: "https://git.novox.be/api/packages/novox/npm/", Username: "mesh-build-node", Password: "pw"}, nil
+		return Registry{URL: "https://git.novox.be/api/packages/novox/npm/", Username: "mesh-build-node", Password: "s3cret-pw!"}, nil
 	}
 	var npmrc string
 	inner := f.effect
@@ -195,7 +195,8 @@ func TestAnotherNovoxPackageIsInstalledFromTheRegistryThroughAUserconfig(t *test
 	if !strings.Contains(npmrc, "@novox:registry=https://git.novox.be/api/packages/novox/npm/") || !strings.Contains(npmrc, ":_auth=") {
 		t.Errorf("npm ci was given the config %q", npmrc)
 	}
-	if strings.Contains(strings.Join(npmCalls(f)[0].args, " "), "pw") {
+	// The password holds characters a workspace's random name never does, so a name like "mvpwby…" is no false match.
+	if strings.Contains(strings.Join(npmCalls(f)[0].args, " "), "s3cret-pw!") {
 		t.Errorf("the credential is on npm's command line")
 	}
 	r := out.(FetchResult)