scripts/verify-release.test.mjs asserts the sanitization stage matches ci.yml
one-for-one; CI 2605 failed on exactly that after SF1 added
test-gitea-login-resolution.sh to ci.yml. Local run: 'node --test
scripts/verify-release.test.mjs' pass.
SF1: test-gitea-login-resolution.sh runs 3/3 green under an empty HOME (no tea
config, no credentials, no brain), so its #1007 'resolves real credentials'
exclusion is stale. Added to ci.yml next to the other hermetic git suites and
removed from the exclusions file. Control: re-adding the exclusion line turns
check-test-enumeration.sh red (rc=1).
SF2: tools/git/README.md identity section now carries the tea-path ladder
(identity -> instance -> <instance>-<identity> login -> fail closed) and points
at tools/fleet/seat-logins.sh as the projector that provisions those logins.
Self-review catch. The ladder reported "no tea login named X exists" when tea
was simply absent -- a cause it never checked, sending the reader off to create a
login they have no tool to create. Same defect class as the one just filed as
#1357, so shipping a fresh instance of it in this PR would be poor form.
get_gitea_login_for_host() returned the FIRST tea login matching the host. With
43 logins on this host, roughly half match one server, so a seat whose own login
was missing silently acted as whichever identity happened to sort first. That
satisfies gate 16 mechanically (an author and a reviewer exist) while violating
it (both are the same actor under two names).
A seat now declares itself via MOSAIC_GIT_IDENTITY or `git config
mosaic.gitIdentity`, and resolution derives the canonical login name from that
identity plus the instance (`<instance>-<seat>`). If that login is absent it
fails closed with a named error and the command to create it. It never borrows.
Same rule on the --repo override path, which had it worse: it fell through to
get_default_tea_login(), i.e. the default-marked login or, failing that, the
first login of ANY host -- an identity chosen by config file order. The four
callers now pass the owner so the instance can be derived. With no identity set
(a human at a terminal) the old fallback is unchanged, which is the same point
at which the token path stops enforcing.
lane-brief.sh mapped owners straight to the SHARED `usc` / `mosaicstack` logins.
The ladder now goes first there, and a seat that cannot resolve its own login
exits rather than falling through to a shared one.
Also adds tools/fleet/seat-logins.sh: projects seat credentials into tea logins
under canonical names, so the name this code requires is one an operator can
mechanically produce rather than hand-maintain.
Test notes:
- The suite had TWO sandbox helpers, run_in_repo and a near-copy run_in_repo2.
The copy drifted: it never got the identity unset, so the suite kept failing on
a provisioned seat after the original was already fixed. run_in_repo2 now
delegates, so the guarantee lives in one place.
- New coverage for both ladder branches (login present -> used; absent -> named
error and NOTHING on stdout, proving it did not borrow the matching login
sitting right there), both identity rungs, the --repo path, and explicit
GITEA_LOGIN outranking the ladder. Each verified by injecting the regression it
claims to catch and confirming it goes red.
- test-issue-create-body-safety.sh now pins the no-identity case; its subject is
body quoting, and an ambient seat identity made it fail for an unrelated reason.
- test-issue-close-fail-closed.sh derives its fixture login from the runner's
identity. This does not make it hermetic and does not claim to: its API-path
cases need a real credential for the runner's own identity, so it passes only
where the runner owns one, on this branch and on its base alike. Pre-existing,
documented in the PR rather than papered over.
fred