4 Commits

Include renames

Author	SHA1	Message	Date
jochen	5bd40fa406	lab_check: work in a fresh directory each time, and name what an earlier check left (hq issue 624) ... lab_check cloned into one fixed path, <work>/check, after an rm -rf whose result it ignored; a tree an earlier check left that the lab's account could not remove made every check fail on "destination path already exists". Each check now works in a fresh check-* directory it removes when done, and clears what earlier checks left, naming any path it could not remove.	2026-10-13 14:40:06 +02:00
jochen	8d8dcd5ebb	lab: a read-only forge account of its own, and no credential left on disk after a stop (hq issue 624, review 196) ... The lab's credential came from the package team, which also writes the @novox packages, and the branches a run clones are not reviewed yet. The lab now contributes {"access": "read"} to its npm-package-registry requirement, and gitea's provisioner puts such a consumer on a team of its own, readers: code read on the org's repositories, package read, no write, and off the package team. The build agent, which publishes, stays on packages. A stop's SIGTERM to the run's process group killed the wrapper before it removed the credential file. The run's script now removes it as soon as its clones are done and traps every way it ends, and a run's start and lab_check remove what a crash or a reboot left.	2026-10-13 14:00:59 +02:00
jochen	789d2d9d64	lab: clone the forge with the credential the mesh binds and seals to the lab (hq issue 624) ... mesh-tools-go is private, and the lab cloned over HTTP with no credential: a run failed at its checkout, "could not read Username". The lab now requires the package registry, as the build agent does; the forge's provisioner binds it an account and seals that account's password, and a run offers them to the forge's own origin through git's credential store, from a file beside the run and removed when it ends: never in a URL, the run's script, an argument or the log. lab_check reads every repository a run clones with that same credential and names one it cannot read.	2026-10-13 13:54:16 +02:00
jochen	c6a9c52dc7	Install each lab checkout where its lock file is, check out mesh-tools-go, and have lab_check catch both (hq issue 624) ... lab_run ran npm ci at the root of mesh-sdk, mesh-tools and mesh-lab; mesh-tools keeps its package in node-tools/ with no lock file at its root, so every run failed at its setup in nine seconds. A run now installs (and, for the SDK and the base, builds) where a package-lock.json is: the root, or each directory one level down; a package.json with no lock file fails the run naming it. It checks out mesh-tools-go, which genesis builds since issue 616, and tells the beds where its checkouts are (MESH_LAB_REPOS). lab_check asks the forge for every repository a run clones and applies the same install rule to the ones it installs, so a run's setup failure is found before a run.	2026-10-13 11:55:01 +02:00