test(e2e): seed the fixture's own master key instead of inheriting CI env - #1270
Open
rigel-mintaka wants to merge 2 commits into
Open
rigel-mintaka wants to merge 2 commits into
rigel-mintaka wants to merge 2 commits into
Conversation
|
Merging to
After your PR is submitted to the merge queue, this comment will be automatically updated with its status. If the PR fails, failure details will also be posted here |
Every podman-tagged test in cmd/compass-stack booted a compass-server with no resolvable at-rest master key, so all nine died at boot on `resolve master key: secrets: resolve: No provider backend configured`. buildUserSecretResolver resolves the key unconditionally and fails closed by design, so a test that boots a server must supply its own. No production change is needed: the supervisor spawns the child with os.Environ(), and compass-server already falls back to $COMPASS_SECRET_PROVIDER, so a t.Setenv in the test process reaches the server. Safe here because the package has no t.Parallel and no TestMain. stackEnv seeds it rather than each caller, because stackEnv snapshots the environment for the subprocess — a provider exported after that call would be captured too late, which is exactly how the --nats-external leg stayed red. Refs RIG-3849 Co-authored-by: Matt Wilkinson <matt@rigel.build>
rigel-mintaka
force-pushed
the
compass-server/rig-3849-stack-podman-key
branch
from
September 17, 2026 02:24
9d35fde to
63d3021
Compare
|
Compass engineering docs preview: https://compass-server-rig-3849-stac.compass-eng-docs.pages.dev Deployed from |
…o ambient Review finding on the parent. The idempotence guard read os.Getenv, so it deferred to a COMPASS_SECRET_PROVIDER already exported in the developer shell — reinstating the ambient dependency the e2e fix removed, and worse: a real provider would seal a throwaway test stack under a real at-rest key. The guard was also unnecessary. t.TempDir returns a unique dir per call (verified: .../001 vs .../002), so a second seed writes a complete, distinct dotenv with the same key; and t.Setenv restores on cleanup, so it never fired across sequential tests either. Its only live effect was the ambient one. Verified with a hostile export: COMPASS_SECRET_PROVIDER=keyring:// now passes, where the guard would have honored it and failed boot. Also drops an invented hazard from the comment (no mechanism could leave an empty dotenv) and records stackEnv seeding before it snapshots. Refs RIG-3849 Co-authored-by: Matt Wilkinson <matt@rigel.build>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Every podman-tagged test in cmd/compass-stack booted a compass-server with no
resolvable at-rest master key, so all nine died at boot on
resolve master key: secrets: resolve: No provider backend configured.buildUserSecretResolver resolves the key unconditionally and fails closed by
design, so a test that boots a server must supply its own.
No production change is needed: the supervisor spawns the child with
os.Environ(), and compass-server already falls back to $COMPASS_SECRET_PROVIDER,
so a t.Setenv in the test process reaches the server. Safe here because the
package has no t.Parallel and no TestMain.
stackEnv seeds it rather than each caller, because stackEnv snapshots the
environment for the subprocess — a provider exported after that call would be
captured too late, which is exactly how the --nats-external leg stayed red.
Refs RIG-3849
Co-authored-by: Matt Wilkinson matt@rigel.build