From 0c3efee932f91d8980242bf1bc405a87f415be08 Mon Sep 17 00:00:00 2001 From: pikastech Date: Tue, 21 Jul 2026 08:53:31 +0200 Subject: [PATCH] fix(cicd): isolate bounded worker result paths --- .../native/hwlab/runtime-pipeline-resource-governance.mjs | 7 ++++++- .../src/platform-infra-pipelines-as-code-bootstrap.test.ts | 4 ++++ 2 files changed, 10 insertions(+), 1 deletion(-) diff --git a/scripts/native/hwlab/runtime-pipeline-resource-governance.mjs b/scripts/native/hwlab/runtime-pipeline-resource-governance.mjs index 2a340ffd..a9561e80 100644 --- a/scripts/native/hwlab/runtime-pipeline-resource-governance.mjs +++ b/scripts/native/hwlab/runtime-pipeline-resource-governance.mjs @@ -43,12 +43,17 @@ function applyPipelineBuildQueue(doc) { let workerScript = publish.script .replaceAll('$(params.service-id)', '$service_id') .replaceAll('/workspace/service-work', '/workspace/service-work/$service_id') - .replaceAll('/tekton/results', '/workspace/service-results-tekton/$service_id'); + .replaceAll('"/tekton/results/" + name', 'process.env.HWLAB_TEKTON_RESULTS_DIR + "/" + name') + .replaceAll('--tekton-results-dir /tekton/results', '--tekton-results-dir "$HWLAB_TEKTON_RESULTS_DIR"'); + if (workerScript.includes('/tekton/results')) { + throw new Error(`CI resource governance task ${governance.matrixTaskName} contains an unsupported Tekton result path context`); + } publish.script = [ 'set -eu', 'build_service() {', ' service_id="$1"', ' mkdir -p "/workspace/service-work/$service_id" "/workspace/service-results-tekton/$service_id"', + ' export HWLAB_TEKTON_RESULTS_DIR="/workspace/service-results-tekton/$service_id"', // Keep the worker body at column zero: POSIX heredoc terminators in the // generated publish script must not be indented by the function wrapper. workerScript, diff --git a/scripts/src/platform-infra-pipelines-as-code-bootstrap.test.ts b/scripts/src/platform-infra-pipelines-as-code-bootstrap.test.ts index acf983f3..ee5cde54 100644 --- a/scripts/src/platform-infra-pipelines-as-code-bootstrap.test.ts +++ b/scripts/src/platform-infra-pipelines-as-code-bootstrap.test.ts @@ -292,6 +292,10 @@ test("bounded HWLAB build worker wrapper preserves heredoc terminators", () => { const source = readFileSync(resolve(import.meta.dir, "../native/hwlab/runtime-pipeline-resource-governance.mjs"), "utf8"); expect(source).toContain("workerScript,"); expect(source).not.toContain("workerScript.split('\\n').map((line) => ` ${line}`).join('\\n')"); + expect(source).toContain('export HWLAB_TEKTON_RESULTS_DIR="/workspace/service-results-tekton/$service_id"'); + expect(source).toContain('process.env.HWLAB_TEKTON_RESULTS_DIR + "/" + name'); + expect(source).toContain('--tekton-results-dir "$HWLAB_TEKTON_RESULTS_DIR"'); + expect(source).toContain("contains an unsupported Tekton result path context"); }); test("L2/L3 release exposes plan first and trigger only sends the PaC webhook", async () => {