Land feature 57's controller work on its release branch

The controller plans config, templates and moved providers' provisions, hands bus accounts to the vault and judges the new manifest words, on the feature's SDK and node-engine validator (feature 57, config and provisioning).
2026-10-15 21:27:33 +00:00
parent fcdecb4361
commit 97a2d841c7
349 changed files with 42440 additions and 786 deletions
@@ -6,6 +6,7 @@ import (
 	"errors"
 	"net/http"
 	"net/http/httptest"
+	"reflect"
 	"slices"
 	"strconv"
 	"strings"
@@ -227,7 +228,8 @@ func TestARecordNoVerdictNamesIsRefusedAndBuilt(t *testing.T) {
 			if got.Reused != nil || len(scratch.took) > 0 || !dockerBuilt(r) {
 				t.Fatalf("a record no verdict names was taken: %+v, copied %v", got.Reused, scratch.took)
 			}
-			if !strings.Contains(got.Why, "no check verdict of the walk's pull requests names it") {
+			if !strings.Contains(got.Why, "no check verdict of the walk's pull requests at the head the forge merged names it") ||
+				!strings.Contains(got.Why, "at head abcdefabcdef") {
 				t.Fatalf("the walk says %q", got.Why)
 			}
 		})
@@ -637,3 +639,153 @@ func TestABuildTwoChecksShareGoesWithTheLastOfThem(t *testing.T) {
 		t.Fatal("the build stayed after the last check naming it went")
 	}
 }
+
+// aCheckAgain is a later check (build-2) of aPull building the module from a tree, with the builds the build seat's
+// verdicts name for it (novox/hq issue 703).
+func aCheckAgain(t *testing.T, scratch *aScratch, tree string, leave []NamedBuild) (CheckBuilt, *recorded) {
+	t.Helper()
+	return aCheckOf(t, scratch, aPull, "abcdefabcdef", tree, leave)
+}
+
+// aCheckOf is a later check (build-2) of a pull request at a head, the trunk moved since build-1.
+func aCheckOf(t *testing.T, scratch *aScratch, pull PullRef, head, tree string, leave []NamedBuild) (CheckBuilt, *recorded) {
+	t.Helper()
+	r, run, workspace := aModuleAt(t, tree)
+	spec := CheckSpec{ID: "build-2", Owner: pull.Owner, Repo: pull.Repo, Number: pull.Number,
+		Builds: []CheckBuildSpec{{Module: "meshboard", Repository: "https://forge.invalid/meshboard.git", Path: "mod",
+			Ref: "main"}}}
+	built := buildForTheMerge(t.Context(), run, spec, CheckBuilding{Publish: r, Scratch: scratch, Named: leave},
+		workspace, "", "", CheckVerdict{Head: head, Trunk: "654321654321"}, GitCredential{}, nil, logging(nil))
+	if len(built) != 1 || built[0].NotBuilt != "" || built[0].Key == "" {
+		t.Fatalf("the second check did not answer the module for its merge: %+v", built)
+	}
+	return built[0], r
+}
+
+// A check asked again when only the trunk moved, whose key is unchanged, builds nothing: it keeps the build an
+// earlier verdict names and names it by key and digest, so the walk can take it (novox/hq issue 703).
+func TestASecondCheckWhoseKeyIsUnchangedBuildsNothingAndNamesTheEarlierBuild(t *testing.T) {
+	withVersion(t, "builder-1")
+	scratch := newScratch()
+	first := aCheckBuilt(t, scratch, "tree-one")
+
+	again, r := aCheckAgain(t, scratch, "tree-one", named(first))
+	if dockerBuilt(r) || len(r.images) > 0 || len(r.archives) > 0 {
+		t.Fatalf("the second check built again: ran %v, published %v %v", r.ran, r.images, r.archives)
+	}
+	if again.Key != first.Key || again.Kept != "build-1" || !reflect.DeepEqual(again.Made, first.Made) {
+		t.Fatalf("the second check names %+v, not the first check's build %+v", again, first)
+	}
+	// The walk takes it by what the second verdict names.
+	leave := named(again)
+	leave[0].Check = again.Kept
+	w, run, workspace := aModuleAt(t, "tree-one")
+	got, err := BuildReusing(t.Context(), run, w, Reuse{Scratch: scratch, Pulls: []PullRef{aPull}, Named: leave},
+		"https://forge.invalid/meshboard.git", "mod", "main", workspace, nil, Npmrc{}, GitCredential{}, nil)
+	if err != nil || got.Reused == nil || dockerBuilt(w) {
+		t.Fatalf("the walk did not take the kept build: %v, why %q", err, got.Why)
+	}
+}
+
+// A check whose key changed builds, as before.
+func TestASecondCheckWhoseKeyChangedBuilds(t *testing.T) {
+	withVersion(t, "builder-1")
+	scratch := newScratch()
+	first := aCheckBuilt(t, scratch, "tree-one")
+
+	again, r := aCheckAgain(t, scratch, "tree-two", named(first))
+	if !dockerBuilt(r) || again.Kept != "" || again.Key == first.Key {
+		t.Fatalf("a check whose key changed did not build: %+v", again)
+	}
+}
+
+// A scratch record no verdict names is never kept: the store takes writes from anything on its network, so a
+// check builds rather than name a planted record (novox/hq issue 703, ADR 0350 §2).
+func TestASecondCheckKeepsNoRecordAVerdictDoesNotName(t *testing.T) {
+	withVersion(t, "builder-1")
+	scratch := newScratch()
+	first := aCheckBuilt(t, scratch, "tree-one")
+	for name, leave := range map[string][]NamedBuild{
+		"no verdict": nil,
+		"another digest": func() []NamedBuild {
+			n := named(first)
+			n[0].Digests["server"] = "sha256:" + strings.Repeat("e", 64)
+			return n
+		}(),
+		"another key": func() []NamedBuild { n := named(first); n[0].Key = "r1:" + strings.Repeat("f", 64); return n }(),
+	} {
+		t.Run(name, func(t *testing.T) {
+			again, r := aCheckAgain(t, scratch, "tree-one", leave)
+			if !dockerBuilt(r) || again.Kept != "" {
+				t.Fatalf("a record no verdict names was kept: %+v", again)
+			}
+		})
+	}
+}
+
+// A build a later check kept stays when the check that built it goes: its artifacts and its record, which the later
+// check's verdict names (novox/hq issue 703, ADR 0350 §5).
+func TestABuildALaterCheckKeptStaysWhenTheCheckThatBuiltItGoes(t *testing.T) {
+	m := &aTaggingRegistry{aRegistryOfRepositories: newRegistryOfRepositories(), tags: map[string]map[string]string{}}
+	server := httptest.NewServer(m.serve())
+	defer server.Close()
+	address := strings.TrimPrefix(server.URL, "http://")
+	registry := Registry{Address: address}
+	ctx := t.Context()
+	now := time.Date(2026, 10, 14, 9, 0, 0, 0, time.UTC)
+
+	body := `{"mediaType":"` + mediaManifestOCI + `","layers":[]}`
+	digest := digestOf([]byte(body))
+	m.manifests["scratch/meshboard/server@"+digest] = []byte(body)
+	key := "r1:" + strings.Repeat("1", 64)
+	b := CheckBuild{Key: key, Module: "meshboard", Pull: aPull, Check: "build-1", At: now,
+		Made: []catalogue.Built{{Name: "server", Kind: "image", Reference: address + "/scratch/meshboard/server@" + digest}}}
+	if err := registry.Keep(ctx, aPull, "build-1", now, []CheckBuild{b}); err != nil {
+		t.Fatal(err)
+	}
+	// Another pull request's check keeps it: its own document names the build, which stays the first check's.
+	other := PullRef{Owner: "novox", Repo: "meshboard", Number: 8}
+	if err := registry.Keep(ctx, other, "build-2", now, []CheckBuild{b}); err != nil {
+		t.Fatal(err)
+	}
+	held := func() bool { _, ok := m.manifests["scratch/meshboard/server@"+digest]; return ok }
+	found := func() bool { _, ok, _ := registry.Find(ctx, "meshboard", key); return ok }
+
+	if n, err := registry.Forget(ctx, aPull); err != nil || n != 1 {
+		t.Fatalf("forgot %d (%v)", n, err)
+	}
+	if !held() || !found() {
+		t.Fatalf("the build a later check names went with the check that built it: held %v, record %v", held(), found())
+	}
+	if n, err := registry.Forget(ctx, other); err != nil || n != 1 {
+		t.Fatalf("forgot %d (%v)", n, err)
+	}
+	if held() || found() {
+		t.Fatalf("the build stayed after the last check naming it went: held %v, record %v", held(), found())
+	}
+}
+
+// Only an earlier check of the same pull request at the same head is kept from: another head of it, or another pull
+// request whose verdict names the same key and digests, builds (novox/hq issue 703).
+func TestACheckKeepsNoBuildOfAnotherHeadOrPullRequest(t *testing.T) {
+	withVersion(t, "builder-1")
+	other := PullRef{Owner: "novox", Repo: "meshboard", Number: 8}
+	for name, c := range map[string]struct {
+		pull PullRef
+		head string
+	}{
+		"another head":         {aPull, "999999999999"},
+		"another pull request": {other, "abcdefabcdef"},
+	} {
+		t.Run(name, func(t *testing.T) {
+			scratch := newScratch()
+			first := aCheckBuilt(t, scratch, "tree-one")
+			leave := named(first)
+			leave[0].Pull = c.pull // as if its own verdict named it
+			again, r := aCheckOf(t, scratch, c.pull, c.head, "tree-one", leave)
+			if !dockerBuilt(r) || again.Kept != "" {
+				t.Fatalf("a build of %s was kept: %+v", name, again)
+			}
+		})
+	}
+}