lab: read the bound forge credential through the tools bundle's env, and check in a fresh directory each time (issue 624) #274

Merged

mesh-admin merged 2 commits from fix/624-lab-check-in-a-fresh-directory into main 2026-10-13 12:58:15 +00:00

Conversation 4 Commits 2 Files Changed 4

+109 -11

2 Commits

Author	SHA1	Message	Date
jochen	dd39d4ace7	lab: name the bound credential in the tools bundle's env, and skip the locked-tree test as root (hq issue 624, reviews 198, 199) ... The lab's tools read their bound npm-package-registry credential, root's at 0600 on the machine. The controller gives the runtime's account exactly the files a tools bundle names in its env (ADR 0192), as gitea and umami are given theirs, so the bundle now names the credential and its binding there, and no other credential changes hands. The merge check runs as root, where no directory mode stops a removal: the test that makes an unremovable tree now skips there before it makes anything, and a second test clears leftovers whoever runs it.	2026-10-13 14:51:18 +02:00
jochen	5bd40fa406	lab_check: work in a fresh directory each time, and name what an earlier check left (hq issue 624) ... lab_check cloned into one fixed path, <work>/check, after an rm -rf whose result it ignored; a tree an earlier check left that the lab's account could not remove made every check fail on "destination path already exists". Each check now works in a fresh check-* directory it removes when done, and clears what earlier checks left, naming any path it could not remove.	2026-10-13 14:40:06 +02:00