secret tests: disable git auto-maintenance so cleanup cannot race it #209

Merged

vnprc merged 1 commit from agent/secret-test-fixture-gc into master

2026-09-12 02:35:15 +01:00

allod-agent commented

2026-09-12 02:34:31 +01:00

Member

The allod package failed to build on the host because one of its own tests is flaky, not because the command is wrong: nixos-rebuild on nexus stopped at TestSecretCreateRendersEachDeclaredValueShape with TempDir RemoveAll cleanup: ... .git/objects/pack: directory not empty. After git commit, git starts a detached maintenance run --auto that takes a lock under .git/objects and may write pack files while the test's temporary directory is already being deleted. The fixtures had gc.auto=0, which stops the collection but not the detached process. This PR sets maintenance.auto=false (plus gc.auto=0 and gc.autoDetach=false) for every git the fixtures and the command under test spawn, through the environment and in the fixture repositories. Test-only change; no command behavior changes. Proof: the failing test reproduced once in 25 runs before the change and passed 60 consecutive runs after it, and the full tagged suite passed five times over. If it is wrong, revert it; the flake returns and nothing else changes.

What changes

cmd/allod/secret_test.go: a gitNoMaintenanceEnv variable (GIT_CONFIG_COUNT keys for maintenance.auto=false, gc.auto=0, gc.autoDetach=false) appended to gitRun's environment and set in the test process environment by newSecretFixture, so the command's own git commit and git push inherit it; both fixture repositories also set maintenance.auto=false in their config.
Nothing under cmd/allod/*.go that ships changes.

Risk

R1. Test-only; the packaged check and the tagged suite are the witnesses.

Validation

Reproduction before the change: go test -tags secret -run TestSecretCreateRendersEachDeclaredValueShape -count=25 failed once with TempDir RemoveAll cleanup: unlinkat .../secrets/.git: directory not empty.
After the change: the same test plus TestSecretRotateRendersEachDeclaredValueShape and TestSecretCreateLandsPendingEntry at -count=60: ok forge.anarch.diy/allod/tools/cmd/allod 43.981s.
go test -tags site,secret -count=5 ./cmd/allod: ok forge.anarch.diy/allod/tools/cmd/allod 38.357s, exit 0
Full gate (gofmt, vet, four tag sets, nix build .#checks.x86_64-linux.go-checks, git diff --check): every command exit 0; nix build built allod-tools-go-checks, gofmt and git diff --check printed nothing

Refs allod/secrets#23

The `allod` package failed to build on the host because one of its own tests is flaky, not because the command is wrong: `nixos-rebuild` on nexus stopped at `TestSecretCreateRendersEachDeclaredValueShape` with `TempDir RemoveAll cleanup: ... .git/objects/pack: directory not empty`. After `git commit`, git starts a detached `maintenance run --auto` that takes a lock under `.git/objects` and may write pack files while the test's temporary directory is already being deleted. The fixtures had `gc.auto=0`, which stops the collection but not the detached process. This PR sets `maintenance.auto=false` (plus `gc.auto=0` and `gc.autoDetach=false`) for every git the fixtures and the command under test spawn, through the environment and in the fixture repositories. Test-only change; no command behavior changes. Proof: the failing test reproduced once in 25 runs before the change and passed 60 consecutive runs after it, and the full tagged suite passed five times over. If it is wrong, revert it; the flake returns and nothing else changes. ## What changes - `cmd/allod/secret_test.go`: a `gitNoMaintenanceEnv` variable (`GIT_CONFIG_COUNT` keys for `maintenance.auto=false`, `gc.auto=0`, `gc.autoDetach=false`) appended to `gitRun`'s environment and set in the test process environment by `newSecretFixture`, so the command's own `git commit` and `git push` inherit it; both fixture repositories also set `maintenance.auto=false` in their config. - Nothing under `cmd/allod/*.go` that ships changes. ## Risk R1. Test-only; the packaged check and the tagged suite are the witnesses. ## Validation - Reproduction before the change: `go test -tags secret -run TestSecretCreateRendersEachDeclaredValueShape -count=25` failed once with `TempDir RemoveAll cleanup: unlinkat .../secrets/.git: directory not empty`. - After the change: the same test plus `TestSecretRotateRendersEachDeclaredValueShape` and `TestSecretCreateLandsPendingEntry` at `-count=60`: `ok forge.anarch.diy/allod/tools/cmd/allod 43.981s`. - `go test -tags site,secret -count=5 ./cmd/allod`: `ok forge.anarch.diy/allod/tools/cmd/allod 38.357s`, exit 0 - Full gate (gofmt, vet, four tag sets, `nix build .#checks.x86_64-linux.go-checks`, `git diff --check`): every command exit 0; `nix build` built `allod-tools-go-checks`, `gofmt` and `git diff --check` printed nothing Refs allod/secrets#23

allod-agent added 1 commit

2026-09-12 02:34:31 +01:00

secret tests: disable git auto-maintenance so cleanup cannot race it 755dcde8c5

git commit starts a detached 'maintenance run --auto' that locks and
writes under .git/objects while t.TempDir is removing the fixture
repository; gc.auto=0 stopped the collection, not the process. Set
maintenance.auto=false for every git the fixtures and the command spawn.

Refs allod/secrets#23