From 0214b45469ecaf44e883936f4550ce78d24560c5 Mon Sep 17 00:00:00 2001 From: mesh-admin Date: Wed, 14 Oct 2026 14:15:19 +0000 Subject: [PATCH] Run mesh-lab's replays where no pull request reaches MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The replays hold the container runtime's socket, yet took their HOME, Go environment, build cache and module cache from the workspace a pull request's own script writes, so a planted -toolexec hook ran as root on the build node (hq issue 709). They now run from a copy of mesh-lab made before anything of the change runs, with a fresh home and the judge cache's caches, as a judge is built (ADR 0358 §6). Co-Authored-By: Claude Opus 5.5 --- internal/builder/check.go | 114 ++++++++++++++++++++++-- internal/builder/release_branch_test.go | 74 ++++++++++++++- 2 files changed, 179 insertions(+), 9 deletions(-) diff --git a/internal/builder/check.go b/internal/builder/check.go index dcd0f5c2..898e1d37 100644 --- a/internal/builder/check.go +++ b/internal/builder/check.go @@ -329,6 +329,13 @@ func Check(ctx context.Context, run Runner, spec CheckSpec, workspace, registry if err := forgetLeftCredentials(workspace); err != nil { return CheckVerdict{}, err } + // **mesh-lab's replays run where no pull request reaches** (novox/hq issue 709, ADR 0358 §6): they hold the + // container runtime's socket, so their sources, home, Go cache and module cache are none of the workspace's. + replay, err := replayDirs(spec.JudgeCache, workspace, root, spec.ID) + if err != nil { + return CheckVerdict{}, err + } + defer os.RemoveAll(replay.base) // cloneAt clones a repository and checks out ref — or, when the repository has no branch ref and orElse is said, // orElse (novox/hq ADR 0358 §3); readAt keeps which, by directory. readAt := map[string]string{} @@ -447,6 +454,12 @@ func Check(ctx context.Context, run Runner, spec CheckSpec, workspace, registry if err := cloneAt(b.Repository, b.Ref, b.Else, dir); err != nil { return CheckVerdict{}, fmt.Errorf("beside it, %w", err) } + if dir == "mesh-lab" && replay.lab != "" { + // The copy the replays run from, made before anything of the change runs, outside every check container. + if err := copyCheckout(ctx, run, filepath.Join(root, dir), replay.lab); err != nil { + return CheckVerdict{}, fmt.Errorf("mesh-lab could not be copied for its replays: %w", err) + } + } if spec.Release != "" { // The branch each was read at is named with its commit (ADR 0358 §4). if judged.BesideAt == nil { @@ -617,6 +630,21 @@ func Check(ctx context.Context, run Runner, spec CheckSpec, workspace, registry return append([]string{args[0], "--volume", judgeHome + ":" + judgeHome, "--volume", judgeGoCache + ":" + judgeGoCache}, args[1:]...) } + replayLab := filepath.Join(root, "mesh-lab") + if replay.lab != "" { + replayLab = replay.lab + } + inReplays := func(env []string, command ...string) []string { + args := in(spec.Toolchain, filepath.Join(replayLab, "replays"), append(ReplayEnv(replay.home, replay.goCache, + replay.modCache), env...), command...) + // The socket goes to the replays alone, never to the change's own code. + mounts := []string{"--volume", "/var/run/docker.sock:/var/run/docker.sock"} + if spec.JudgeCache != "" { + mounts = append(mounts, "--volume", replay.base+":"+replay.base, "--volume", replay.goCache+":"+replay.goCache, + "--volume", replay.modCache+":"+replay.modCache) + } + return append(append([]string{args[0]}, mounts...), args[1:]...) + } var out tail // running runs one container of the check, its output into the report, in a process group of its own. running := func(args []string) error { @@ -670,7 +698,7 @@ func Check(ctx context.Context, run Runner, spec CheckSpec, workspace, registry say("check", "the gate: %d module(s) of the graph touched — %s", len(modules), strings.Join(modules, ", ")) fmt.Fprintf(&out, "--- the gate: %s\n", strings.Join(modules, ", ")) v.Gate.Verdict, v.Gate.Summary = gateLayer(ctx, spec, tree, root, gate, verdictFile, env, inToolchain, - running, &out, bus, workspace, name, say) + running, &out, bus, name, replayLab, inReplays, say) } if timedOut() { v.Gate.Verdict, v.Gate.Summary = "error", fmt.Sprintf("the check ran past %s and was ended", CheckTimeout) @@ -947,8 +975,9 @@ const SomeManifestsEnv = "MESH_MODULE_CHECK_SOME=1" // gateLayer runs the gate: the touched manifests through `module check`, every machine composed with the // change, and the replays of what the mesh runs. It answers the gate's verdict and summary. func gateLayer(ctx context.Context, spec CheckSpec, tree, root, gate, verdictFile string, env []string, - inToolchain func(string, []string, ...string) []string, running func([]string) error, out *tail, bus, workspace, - name string, say func(step, format string, args ...any)) (string, string) { + inToolchain func(string, []string, ...string) []string, running func([]string) error, out *tail, bus, + name, replayLab string, inReplays func([]string, ...string) []string, + say func(step, format string, args ...any)) (string, string) { // 1. The manifests the change touches, as the judge reads them: a manifest it cannot read, or one with a // problem the change brings, fails here. **What was already so on the base branch is said and fails // nothing** — the gate's own rule: a module whose manifest the running controller already finds fault @@ -1040,7 +1069,7 @@ func gateLayer(ctx context.Context, spec CheckSpec, tree, root, gate, verdictFil // 3. **The replays of what the mesh runs** (to-be 45 §9, M9): mesh-lab's, from its main — reviewed code, // so given the container runtime the resolver replay raises containers with — against the bus of the // release the mesh runs and the change's own catalogue when the change is to the catalogue. - if lab := filepath.Join(root, "mesh-lab", "replays"); ctx.Err() == nil { + if lab := filepath.Join(replayLab, "replays"); ctx.Err() == nil { if _, err := os.Stat(lab); err == nil { catalogue := filepath.Join(root, "mesh-catalog") if name == "mesh-catalog" { @@ -1048,11 +1077,10 @@ func gateLayer(ctx context.Context, spec CheckSpec, tree, root, gate, verdictFil } say("check", "the replays of what the mesh runs, from mesh-lab") fmt.Fprintln(out, "--- the replays (mesh-lab replays/)") - args := inToolchain(lab, []string{EnvTestBus + "=nats://" + bus, "MESH_REPLAY_CATALOGUE=" + catalogue, - "GOCACHE=" + filepath.Join(workspace, "go-cache"), "GOMODCACHE=" + filepath.Join(workspace, "go-modules")}, + // In the replays' own environment (inReplays): reviewed code, the socket, and nothing the workspace holds + // but the catalogue they read. + args := inReplays([]string{EnvTestBus + "=nats://" + bus, "MESH_REPLAY_CATALOGUE=" + catalogue}, "go", "test", "-count=1", "./...") - // The socket goes to the replays alone, never to the change's own code above. - args = append([]string{args[0], "--volume", "/var/run/docker.sock:/var/run/docker.sock"}, args[1:]...) if err := running(args); err != nil { if ctx.Err() != nil { return "error", "the check was ended during the replays" @@ -1225,6 +1253,76 @@ func judgeBuildDirs(cache, workspace, root, id string) (string, string, error) { return home, goCache, nil } +// replayPlace is where mesh-lab's replays run from and with (novox/hq issue 709): base, the directory made for this +// check and removed after it; lab, the copy of mesh-lab they run (empty: the checkout beside the check); home, their +// HOME and configuration; and the Go build and module caches. +type replayPlace struct { + base, lab, home, goCache, modCache string +} + +// replayDirs makes the replays' place (issue 709, ADR 0358 §6). With a judge cache: a directory under its homes/ for +// this check, holding a copy of mesh-lab made before anything of the change runs and a fresh home, and the judge +// cache's Go build and module caches — none of which a check's container mounts. The replays' build is as trusted as a +// judge's: it compiles mesh-lab's trunk, reviewed code, and nothing of the pull request. Without a judge cache: a home +// and caches under the check's root, which every check empties before it clones, and the replays run from the +// checkout beside the check, as before. +func replayDirs(cache, workspace, root, id string) (replayPlace, error) { + if cache == "" { + p := replayPlace{base: filepath.Join(root, "replay-home"), goCache: filepath.Join(root, "judge-go-cache"), + modCache: filepath.Join(root, "replay-go-modules")} + p.home = p.base + for _, d := range []string{p.home, p.goCache, p.modCache} { + if err := os.MkdirAll(d, 0o700); err != nil { + return replayPlace{}, err + } + } + return p, nil + } + if withinDir(workspace, cache) { + return replayPlace{}, fmt.Errorf("the judge cache %s is inside the workspace %s, which a check's containers "+ + "mount: no replay is run where a pull request could reach it", cache, workspace) + } + if !safeName.MatchString(id) { + id = "check" + } + base := filepath.Join(cache, "homes", id+"-replays") + p := replayPlace{base: base, lab: filepath.Join(base, "mesh-lab"), home: filepath.Join(base, "home"), + goCache: filepath.Join(cache, "go-cache"), modCache: filepath.Join(cache, "go-modules")} + if err := os.RemoveAll(base); err != nil { + return replayPlace{}, err + } + for _, d := range []string{p.home, p.goCache, p.modCache} { + if err := os.MkdirAll(d, 0o700); err != nil { + return replayPlace{}, err + } + } + return p, nil +} + +// ReplayEnv is the environment mesh-lab's replays run in (novox/hq issue 709): home as HOME and configuration, the Go +// build and module caches given, no global or system git configuration, no Go environment file, and no version +// stamped from git — as a judge is built (JudgeBuildEnv), with the modules the replays fetch. +func ReplayEnv(home, goCache, modCache string) []string { + return []string{"HOME=" + home, "XDG_CONFIG_HOME=" + filepath.Join(home, ".config"), + "GIT_CONFIG_GLOBAL=/dev/null", "GIT_CONFIG_NOSYSTEM=1", "GOENV=off", + "GOCACHE=" + goCache, "GOMODCACHE=" + modCache, "GOPATH=" + filepath.Join(home, "go"), + "GOFLAGS=-buildvcs=false"} +} + +// copyCheckout copies a checkout at the commit it stands at into dir, over git's own transport — never by linking +// objects — so what is written into the source afterwards does not reach the copy. +func copyCheckout(ctx context.Context, run Runner, from, dir string) error { + commit := fullHeadAt(ctx, run, from) + if commit == "" { + return fmt.Errorf("%s names no commit", from) + } + if _, err := run(ctx, filepath.Dir(dir), "git", "clone", "--quiet", "--no-local", "--no-checkout", from, dir); err != nil { + return err + } + _, err := run(ctx, dir, "git", "checkout", "--quiet", "--detach", commit) + return err +} + // keptJudges is where a judge cache keeps the release-branch judges, empty when there is no judge cache. func keptJudges(cache string) string { if cache == "" { diff --git a/internal/builder/release_branch_test.go b/internal/builder/release_branch_test.go index 123c13c0..d1ea2c27 100644 --- a/internal/builder/release_branch_test.go +++ b/internal/builder/release_branch_test.go @@ -147,6 +147,9 @@ run) shift if [ "$1" = go ]; then echo "GOCACHE=$GOCACHE GOENV=$GOENV $*" >> "` + built + `"; fi if [ "$1" = go ] && [ "$2" = build ] && [ -n "$JUDGE_HOMES" ]; then echo "$HOME" >> "$JUDGE_HOMES"; fi + if [ "$1" = go ] && [ "$2" = test ] && [ -n "$REPLAYS" ]; then + echo "HOME=$HOME GOCACHE=$GOCACHE GOMODCACHE=$GOMODCACHE GOENV=$GOENV GOFLAGS=$GOFLAGS DIR=$workdir" >> "$REPLAYS" + fi cd "$workdir" && exec "$@" ;; esac exit 1 @@ -362,7 +365,7 @@ func TestWithoutTheNodeEnginesReleaseBranchTheJudgeKeepsItsVendoredValidator(t * } } -// **Clause 5** (ADR 0358 §5): a release branch's own pull request into its trunk is checked as any pull request into a +// **Clause 7** (ADR 0358 §7): a release branch's own pull request into its trunk is checked as any pull request into a // trunk — by the controller beside it as the mesh runs it, the repositories at what a trunk check reads — and its // verdict names no release branch. func TestAReleaseBranchsPullRequestIntoItsTrunkIsJudgedByTheControllerTheMeshRuns(t *testing.T) { @@ -652,3 +655,72 @@ func TestWithoutAJudgeCacheAJudgeIsBuiltColdUnderTheChecksRoot(t *testing.T) { t.Fatalf("a judge cache inside the workspace was taken: %v", err) } } + +// aLabWithReplays is mesh-lab with replays: a Go module of its own whose one test passes, needing nothing fetched. +func aLabWithReplays(t *testing.T) (string, string) { + t.Helper() + lab, labMain, _ := aRepositoryWithARelease(t, map[string]string{ + "replays/go.mod": "module example.org/replays\n\ngo 1.22\n", + "replays/replay_test.go": "package replays\n\nimport \"testing\"\n\nfunc TestAReplay(t *testing.T) {}\n", + }, nil) + return lab, labMain +} + +// **mesh-lab's replays run where no pull request reaches** (novox/hq issue 709, ADR 0358 §6): they hold the container +// runtime's socket, so a Go environment file with a -toolexec hook and a Go cache and module cache planted in the +// workspace by a pull request's script are neither run nor read — the replays run from a copy of mesh-lab outside +// the workspace with a fresh home and the judge cache's caches, all removed or kept outside every check container. +func TestTheReplaysRunWhereNoPullRequestReaches(t *testing.T) { + aRuntimeThatBuildsTheJudge(t) + replays := filepath.Join(t.TempDir(), "replays") + t.Setenv("REPLAYS", replays) + registry := aFactsRegistry(t) + workspace, ran := aPlantedWorkspace(t) + for _, poisoned := range []string{filepath.Join(workspace, "go-cache", "README"), + filepath.Join(workspace, "go-modules", "cache", "download", "planted")} { + if err := os.MkdirAll(filepath.Dir(poisoned), 0o755); err != nil { + t.Fatal(err) + } + if err := os.WriteFile(poisoned, []byte("planted by a pull request"), 0o644); err != nil { + t.Fatal(err) + } + } + cache := t.TempDir() + controller, controllerMain, _ := aRepositoryWithARelease(t, aJudgeOf("the controller the mesh runs"), nil) + lab, labMain := aLabWithReplays(t) + catalogue, head := aPullRequestInto(t, map[string]string{"modules/gitea/module.json": `{"module":"gitea"}`, + CheckScript: "true\n"}, "main", map[string]string{"modules/gitea/index.ts": "x"}) + v, err := Check(t.Context(), Command, CheckSpec{ID: "check-709", Repository: catalogue, Ref: head, Owner: "novox", + Repo: "mesh-catalog", Number: 1, Base: "main", JudgeCache: cache, Paths: []string{"modules/gitea/index.ts"}, + Modules: []string{"gitea"}, Toolchain: "golang", Beside: map[string]Beside{ + "mesh-controller": {Repository: controller, Ref: controllerMain}, "mesh-lab": {Repository: lab, Ref: labMain}}}, + workspace, registry, GitCredential{}, nil) + if err != nil { + t.Fatal(err) + } + if v.Gate == nil || v.Gate.Verdict != "pass" || !strings.Contains(v.Report, "--- the replays") { + t.Fatalf("the replays did not run and pass: %+v\n%s", v.Gate, v.Report) + } + body, _ := os.ReadFile(replays) + said := strings.TrimSpace(string(body)) + if said == "" || strings.Count(said, "\n") != 0 { + t.Fatalf("the replays ran %q, not once", said) + } + for _, want := range []string{"GOCACHE=" + filepath.Join(cache, "go-cache") + " ", + "GOMODCACHE=" + filepath.Join(cache, "go-modules") + " ", "GOENV=off ", "GOFLAGS=-buildvcs=false ", + "HOME=" + filepath.Join(cache, "homes", "check-709-replays", "home") + " ", + "DIR=" + filepath.Join(cache, "homes", "check-709-replays", "mesh-lab", "replays")} { + if !strings.Contains(said, want) { + t.Fatalf("the replays did not run with %q: %s", want, said) + } + } + if strings.Contains(said, workspace) { + t.Fatalf("the replays ran with something of the workspace: %s", said) + } + if body, _ := os.ReadFile(ran); strings.Contains(string(body), "replays") || strings.Contains(string(body), "mesh-lab") { + t.Fatalf("a hook planted in the workspace ran during the replays:\n%s", body) + } + if left, _ := os.ReadDir(filepath.Join(cache, "homes")); len(left) != 0 { + t.Fatalf("the replays left %d entr(ies) under the judge cache's homes", len(left)) + } +}