(tsEnv testScriptEnv)
| 284 | var keyT struct{} |
| 285 | |
| 286 | func sharedSetup(tsEnv testScriptEnv) func(ts *testscript.Env) error { |
| 287 | return func(ts *testscript.Env) error { |
| 288 | scriptName, ok := extractScriptName(ts.Vars) |
| 289 | if !ok { |
| 290 | ts.T().Fatal("script name not found") |
| 291 | } |
| 292 | |
| 293 | // When using script name to uniquely identify where test data comes from, |
| 294 | // some places like GitHub Actions secret names don't accept hyphens. |
| 295 | // Replace them with underscores until such a time this becomes a problem. |
| 296 | ts.Setenv("SCRIPT_NAME", strings.ReplaceAll(scriptName, "-", "_")) |
| 297 | ts.Setenv("HOME", ts.Cd) |
| 298 | ts.Setenv("GH_CONFIG_DIR", ts.Cd) |
| 299 | |
| 300 | ts.Setenv("GH_HOST", tsEnv.host) |
| 301 | ts.Setenv("ORG", tsEnv.org) |
| 302 | |
| 303 | if tsEnv.apiHost == "" { |
| 304 | ts.Setenv("GH_TOKEN", tsEnv.token) |
| 305 | } else { |
| 306 | // api_host is only readable from hosts.yml, and a GH_TOKEN in the |
| 307 | // environment resolves auth without ever consulting that file, so |
| 308 | // the token has to move into the same place as the override. |
| 309 | hostsFile := filepath.Join(ts.Cd, "hosts.yml") |
| 310 | hostsContent := fmt.Sprintf(""+ |
| 311 | "%[1]s:\n"+ |
| 312 | " user: %[2]s\n"+ |
| 313 | " oauth_token: %[3]s\n"+ |
| 314 | " git_protocol: https\n"+ |
| 315 | " api_host: %[4]s\n"+ |
| 316 | " users:\n"+ |
| 317 | " %[2]s:\n"+ |
| 318 | " oauth_token: %[3]s\n", |
| 319 | tsEnv.host, tsEnv.user, tsEnv.token, tsEnv.apiHost) |
| 320 | if err := os.WriteFile(hostsFile, []byte(hostsContent), 0o600); err != nil { |
| 321 | return fmt.Errorf("writing sandbox hosts.yml: %w", err) |
| 322 | } |
| 323 | } |
| 324 | |
| 325 | ts.Setenv("RANDOM_STRING", randomString(10)) |
| 326 | |
| 327 | ts.Setenv("GH_TELEMETRY", "false") |
| 328 | |
| 329 | // testscript constructs a fresh environment from a fixed allowlist and |
| 330 | // does not propagate SSL_CERT_FILE. When the operator has set it - for |
| 331 | // instance because all API traffic routes through a gateway whose CA is |
| 332 | // not in the system bundle - honour that intent explicitly, or every |
| 333 | // request inside the sandbox will fail certificate verification. |
| 334 | if certFile := os.Getenv("SSL_CERT_FILE"); certFile != "" { |
| 335 | ts.Setenv("SSL_CERT_FILE", certFile) |
| 336 | } |
| 337 | |
| 338 | // The sandbox overrides HOME, so git cannot find the user's global |
| 339 | // config. Write a minimal identity so commits inside the sandbox |
| 340 | // don't fail with "Author identity unknown". |
| 341 | gitCfg := filepath.Join(ts.Cd, ".gitconfig") |
| 342 | gitCfgContent := heredoc.Doc(` |
| 343 | [user] |
no test coverage detected