Build for the merge from a copy its tests never touch, and keep or take only the same head's build

The gate and the repository's check mount the workspace read-write, so a
build from that tree could hold what the tests wrote under a key that
describes the merge. A check now clones the merge outside the workspace
before anything of the change runs, and builds from that. A check keeps,
and a walk takes, only a build an earlier check of the same pull request
at the same head made: another pull request's build, or an earlier
head's, is never registered. The walk reads the verdicts once
(novox/hq issue 703, review of #328).

cmd/mesh-controller/check_builds_test.go

@@ -190,52 +190,75 @@ func TestAReusedCheckBuildIsRegisteredByItsDigestAndGatedAsABuiltOne(t *testing.
 	}
 }
 
-// A walk's leave names the builds its own pull requests' verdicts made, and none when they cannot be read: the
-// builder takes nothing a verdict does not name (novox/hq ADR 0350 §2).
+// A walk's leave names the builds its own pull requests' verdicts made at the head each merge merged — never an
+// earlier head's — read once per walk, and none when they cannot be read: the builder takes nothing a verdict does
+// not name (novox/hq ADR 0350 §2, issue 703).
 func TestAWalksLeaveNamesTheBuildsItsPullRequestsVerdictsMade(t *testing.T) {
 	was := checkedBuildsOf
-	t.Cleanup(func() { checkedBuildsOf = was })
-	var asked []link.PullRef
-	named := []link.CheckedBuild{{Pull: link.PullRef{Owner: "novox", Repo: "shop", Number: 7}, Check: "build-1",
-		Built: link.CheckBuilt{Module: "app", Key: "r1:1"}}}
+	forgetWalkVerdicts()
+	t.Cleanup(func() { checkedBuildsOf = was; forgetWalkVerdicts() })
+	var asked [][]link.PullRef
+	pull := link.PullRef{Owner: "novox", Repo: "shop", Number: 7}
+	atHead := link.CheckedBuild{Pull: pull, Check: "build-2", Head: "bbbbbbbbbbbb", Built: link.CheckBuilt{Module: "app", Key: "r1:2"}}
+	earlier := link.CheckedBuild{Pull: pull, Check: "build-1", Head: "aaaaaaaaaaaa", Built: link.CheckBuilt{Module: "app", Key: "r1:1"}}
 	checkedBuildsOf = func(_ context.Context, pulls []link.PullRef) ([]link.CheckedBuild, error) {
-		asked = pulls
-		return named, nil
+		asked = append(asked, pulls)
+		return []link.CheckedBuild{atHead, earlier}, nil
 	}
-	pulls := []link.PullRef{{Owner: "novox", Repo: "shop", Number: 7}}
-	if got := reuseWithVerdicts(t.Context(), &link.ReuseAsk{Pulls: pulls}); !reflect.DeepEqual(got.Builds, named) ||
-		!reflect.DeepEqual(asked, pulls) {
-		t.Fatalf("the leave names %+v, read for %+v", got.Builds, asked)
+	pulls := []link.PullRef{pull}
+	heads := map[link.PullRef]string{pull: "bbbbbbbbbbbb0123456789"}
+	for range 3 {
+		if got := reuseWithVerdicts(t.Context(), "plan-1", &link.ReuseAsk{Pulls: pulls}, heads); !reflect.DeepEqual(got.Builds,
+			[]link.CheckedBuild{atHead}) {
+			t.Fatalf("the leave names %+v, not only the merged head's build", got.Builds)
+		}
+	}
+	if !reflect.DeepEqual(asked, [][]link.PullRef{pulls}) {
+		t.Fatalf("the verdicts were read %d times for one walk: %v", len(asked), asked)
+	}
+	// A merge whose head was not said takes nothing.
+	if got := reuseWithVerdicts(t.Context(), "plan-1", &link.ReuseAsk{Pulls: pulls}, nil); got.Builds != nil {
+		t.Fatalf("a merge of no said head names %+v", got.Builds)
 	}
 	checkedBuildsOf = func(context.Context, []link.PullRef) ([]link.CheckedBuild, error) {
 		return nil, errors.New("no bus")
 	}
-	if got := reuseWithVerdicts(t.Context(), &link.ReuseAsk{Pulls: pulls}); got.Builds != nil {
+	if got := reuseWithVerdicts(t.Context(), "plan-2", &link.ReuseAsk{Pulls: pulls}, heads); got.Builds != nil {
 		t.Fatalf("verdicts that could not be read named %+v", got.Builds)
 	}
 }
 
-// A check is handed the builds the seat's verdicts name for the modules it builds, read once, and none when they
-// cannot be read (novox/hq issue 703).
-func TestACheckIsHandedTheBuildsTheVerdictsNameForItsModules(t *testing.T) {
-	was := checkedBuildsOfModules
-	t.Cleanup(func() { checkedBuildsOfModules = was })
-	var asked [][]string
-	named := []link.CheckedBuild{{Pull: link.PullRef{Owner: "novox", Repo: "shop", Number: 7}, Check: "build-1",
-		Built: link.CheckBuilt{Module: "app", Key: "r1:1"}}}
-	checkedBuildsOfModules = func(_ context.Context, modules []string) ([]link.CheckedBuild, error) {
-		asked = append(asked, modules)
-		return named, nil
+// A check is handed only the builds earlier checks of its own pull request at its own head made: another pull
+// request's build, or an earlier head's, is never kept (novox/hq issue 703). None when they cannot be read.
+func TestACheckIsHandedOnlyItsOwnHeadsBuilds(t *testing.T) {
+	was := checkedBuildsOf
+	t.Cleanup(func() { checkedBuildsOf = was })
+	pull := link.PullRef{Owner: "novox", Repo: "shop", Number: 7}
+	mine := link.CheckedBuild{Pull: pull, Check: "build-1", Head: "bbbbbbbbbbbb", Built: link.CheckBuilt{Module: "app", Key: "r1:1"}}
+	earlier := link.CheckedBuild{Pull: pull, Check: "build-0", Head: "aaaaaaaaaaaa", Built: link.CheckBuilt{Module: "app", Key: "r1:1"}}
+	another := link.CheckedBuild{Pull: link.PullRef{Owner: "novox", Repo: "shop", Number: 8}, Check: "build-9",
+		Head: "bbbbbbbbbbbb", Built: link.CheckBuilt{Module: "app", Key: "r1:1"}}
+	var asked [][]link.PullRef
+	checkedBuildsOf = func(_ context.Context, pulls []link.PullRef) ([]link.CheckedBuild, error) {
+		asked = append(asked, pulls)
+		return []link.CheckedBuild{mine, earlier, another}, nil
 	}
-	builds := []link.CheckBuild{{Module: "app"}, {Module: "web", Skip: "the merge deletes it"}}
-	if got := namedForTheCheck(t.Context(), builds); !reflect.DeepEqual(got, named) ||
-		!reflect.DeepEqual(asked, [][]string{{"app"}}) {
-		t.Fatalf("the check is handed %+v, read %v", got, asked)
+	p := link.PullUpdated{Owner: "novox", Repo: "shop", Number: 7, Commit: "bbbbbbbbbbbb0123456789"}
+	builds := []link.CheckBuild{{Module: "app"}}
+	if got := namedForTheCheck(t.Context(), p, builds); !reflect.DeepEqual(got, []link.CheckedBuild{mine}) ||
+		!reflect.DeepEqual(asked, [][]link.PullRef{{pull}}) {
+		t.Fatalf("the check is handed %+v, read for %v", got, asked)
 	}
-	checkedBuildsOfModules = func(context.Context, []string) ([]link.CheckedBuild, error) {
+	checkedBuildsOf = func(context.Context, []link.PullRef) ([]link.CheckedBuild, error) {
 		return nil, errors.New("no bus")
 	}
-	if got := namedForTheCheck(t.Context(), builds); got != nil {
+	if got := namedForTheCheck(t.Context(), p, builds); got != nil {
 		t.Fatalf("verdicts that could not be read named %+v", got)
 	}
 }
+
+func forgetWalkVerdicts() {
+	walkVerdicts.Lock()
+	defer walkVerdicts.Unlock()
+	walkVerdicts.read = map[string]verdictsRead{}
+}