fix(ci): bind remote fixture downstream source

tools/e2e-install-test.sh

@@ -16,6 +16,8 @@ GIT_MODE="${MOSAIC_INSTALL_GIT_MODE:-present}"
 INSTALLER_FILE="${MOSAIC_FIXTURE_INSTALLER_FILE:-$ROOT/tools/install.sh}"
 INSTALLER_URL="${MOSAIC_FIXTURE_INSTALLER_URL:-}"
 INSTALLER_SHA256="${MOSAIC_FIXTURE_INSTALLER_SHA256:-}"
+SOURCE_COMMIT="${MOSAIC_FIXTURE_SOURCE_COMMIT:-}"
+SOURCE_SHA256="${MOSAIC_FIXTURE_SOURCE_SHA256:-}"
 IN_CLEAN_CONTAINER="${MOSAIC_GREENFIELD_CONTAINER:-0}"
 
 usage() {
@@ -45,6 +47,10 @@ if [[ "$SOURCE" == remote ]]; then
   [[ -n "$INSTALLER_URL" ]] || INSTALLER_URL="https://git.mosaicstack.dev/mosaicstack/stack/raw/branch/${LANE}/tools/install.sh"
   [[ "$INSTALLER_SHA256" =~ ^[0-9a-f]{64}$ ]] \
     || { echo '[fixture] remote source requires MOSAIC_FIXTURE_INSTALLER_SHA256=64hex' >&2; exit 2; }
+  [[ "$SOURCE_COMMIT" =~ ^[0-9a-f]{40}$ ]] \
+    || { echo '[fixture] remote source requires MOSAIC_FIXTURE_SOURCE_COMMIT=40hex' >&2; exit 2; }
+  [[ -z "$SOURCE_SHA256" || "$SOURCE_SHA256" =~ ^[0-9a-f]{64}$ ]] \
+    || { echo '[fixture] MOSAIC_FIXTURE_SOURCE_SHA256 must be empty or 64hex' >&2; exit 2; }
 fi
 
 if [[ "$IN_CLEAN_CONTAINER" != "1" ]]; then
@@ -94,13 +100,20 @@ packages=(bash ca-certificates curl jq passwd python3 util-linux)
 [[ "$FIXTURE_GIT_MODE" == "present" ]] && packages+=(git)
 apt-get install -y -qq "${packages[@]}" >/dev/null
 
+source_archive=/tmp/source-checkout.tar.gz
+source_commit=""
+source_sha256=""
+expected_source_commit=""
+expected_source_sha256=""
+
 if [[ "$FIXTURE_SOURCE" == "checkout" ]]; then
-  awk 'found { print } /^__MOSAIC_CHECKOUT_ARCHIVE__$/ { found=1; next }' "$0" | base64 -d > /tmp/source-checkout.tar.gz
-  actual_checkout_digest="$(sha256sum /tmp/source-checkout.tar.gz | awk '{print $1}')"
-  if [[ "$actual_checkout_digest" != "$FIXTURE_CHECKOUT_SHA256" ]]; then
+  awk 'found { print } /^__MOSAIC_CHECKOUT_ARCHIVE__$/ { found=1; next }' "$0" | base64 -d > "$source_archive"
+  source_sha256="$(sha256sum "$source_archive" | awk '{print $1}')"
+  if [[ "$source_sha256" != "$FIXTURE_CHECKOUT_SHA256" ]]; then
     echo "[fixture] checkout archive transport digest mismatch" >&2
     exit 1
   fi
+  source_commit="$FIXTURE_CHECKOUT_CONTENT_ID"
 fi
 
 useradd --create-home --uid 1001 --shell /bin/bash mosaic
@@ -118,6 +131,18 @@ case "$FIXTURE_SOURCE" in
       echo "[fixture] remote installer digest mismatch got=$actual_installer_sha256 expected=$FIXTURE_INSTALLER_SHA256" >&2
       exit 1
     }
+    curl -fsSL --max-filesize 268435456 \
+      "https://git.mosaicstack.dev/mosaicstack/stack/archive/${FIXTURE_SOURCE_COMMIT}.tar.gz" \
+      -o "$source_archive"
+    [[ -s "$source_archive" ]] || { echo '[fixture] remote source archive returned an empty HTTP-success body' >&2; exit 1; }
+    source_sha256="$(sha256sum "$source_archive" | awk '{print $1}')"
+    if [[ -n "$FIXTURE_SOURCE_SHA256" && "$source_sha256" != "$FIXTURE_SOURCE_SHA256" ]]; then
+      echo "[fixture] remote source archive digest mismatch got=$source_sha256 expected=$FIXTURE_SOURCE_SHA256" >&2
+      exit 1
+    fi
+    source_commit="$FIXTURE_SOURCE_COMMIT"
+    expected_source_commit="$source_commit"
+    expected_source_sha256="$source_sha256"
     ;;
 esac
 chmod 0755 /tmp/install.sh
@@ -167,6 +192,22 @@ wait "$installer_pid"
 install_status=$?
 set -e
 cat "$install_log"
+
+if [[ -n "$FIXTURE_EXPECTED_SOURCE_COMMIT" ]]; then
+  manifest="$mosaic_home/.install-manifest.json"
+  realised_source_commit="$(node -p "require('$manifest').sourceCommit || ''" 2>/dev/null || true)"
+  realised_source_sha256="$(node -p "require('$manifest').sourceSha256 || ''" 2>/dev/null || true)"
+  if [[ "$realised_source_commit" != "$FIXTURE_EXPECTED_SOURCE_COMMIT" \
+    || "$realised_source_sha256" != "$FIXTURE_EXPECTED_SOURCE_SHA256" ]]; then
+    printf '[SOURCE-CONTROL] FAIL: realised_commit=%s expected_commit=%s realised_sha256=%s expected_sha256=%s\n' \
+      "${realised_source_commit:-missing}" "$FIXTURE_EXPECTED_SOURCE_COMMIT" \
+      "${realised_source_sha256:-missing}" "$FIXTURE_EXPECTED_SOURCE_SHA256" >&2
+    exit 1
+  fi
+  printf '[SOURCE-CONTROL] PASS: realised_commit=%s realised_sha256=%s\n' \
+    "$realised_source_commit" "$realised_source_sha256"
+fi
+
 probe_ok=true
 if [[ "$FIXTURE_GIT_MODE" == present ]] \
   && ! grep -q '^\[REDACTION-PROBE\] emitted=\[REDACTED\]$' "$install_log"; then
@@ -349,9 +390,11 @@ exec runuser -u mosaic -- env -i \
   FIXTURE_GIT_MODE="$FIXTURE_GIT_MODE" \
   FIXTURE_FRAMEWORK_PAYLOAD_COUNT="$FIXTURE_FRAMEWORK_PAYLOAD_COUNT" \
   FIXTURE_REPO_ROOT_COUNT="$FIXTURE_REPO_ROOT_COUNT" \
-  MOSAIC_INSTALL_LOCAL_SOURCE_ARCHIVE="$([[ "$FIXTURE_SOURCE" == "checkout" ]] && echo /tmp/source-checkout.tar.gz)" \
-  MOSAIC_INSTALL_LOCAL_SOURCE_COMMIT="$FIXTURE_CHECKOUT_CONTENT_ID" \
-  MOSAIC_INSTALL_LOCAL_SOURCE_SHA256="$FIXTURE_CHECKOUT_SHA256" \
+  FIXTURE_EXPECTED_SOURCE_COMMIT="$expected_source_commit" \
+  FIXTURE_EXPECTED_SOURCE_SHA256="$expected_source_sha256" \
+  MOSAIC_INSTALL_LOCAL_SOURCE_ARCHIVE="$source_archive" \
+  MOSAIC_INSTALL_LOCAL_SOURCE_COMMIT="$source_commit" \
+  MOSAIC_INSTALL_LOCAL_SOURCE_SHA256="$source_sha256" \
   /bin/bash /tmp/run-as-target.sh
 INNER
 if [[ "$SOURCE" == "checkout" ]]; then
@@ -375,6 +418,8 @@ if [[ "$IN_CLEAN_CONTAINER" == "1" ]]; then
   FIXTURE_INSTALLER_B64="$installer_b64" \
   FIXTURE_INSTALLER_URL="$INSTALLER_URL" \
   FIXTURE_INSTALLER_SHA256="$INSTALLER_SHA256" \
+  FIXTURE_SOURCE_COMMIT="$SOURCE_COMMIT" \
+  FIXTURE_SOURCE_SHA256="$SOURCE_SHA256" \
   FIXTURE_CHECKOUT_SHA256="$checkout_digest" \
   FIXTURE_CHECKOUT_CONTENT_ID="$checkout_content_id" \
   FIXTURE_FRAMEWORK_PAYLOAD_COUNT="$framework_payload_count" \
@@ -393,6 +438,8 @@ else
     --env FIXTURE_INSTALLER_B64="$installer_b64" \
     --env FIXTURE_INSTALLER_URL="$INSTALLER_URL" \
     --env FIXTURE_INSTALLER_SHA256="$INSTALLER_SHA256" \
+    --env FIXTURE_SOURCE_COMMIT="$SOURCE_COMMIT" \
+    --env FIXTURE_SOURCE_SHA256="$SOURCE_SHA256" \
     --env FIXTURE_CHECKOUT_SHA256="$checkout_digest" \
     --env FIXTURE_CHECKOUT_CONTENT_ID="$checkout_content_id" \
     --env FIXTURE_FRAMEWORK_PAYLOAD_COUNT="$framework_payload_count" \