(tsEnv testScriptEnv)
| 857 | var keyT struct{} |
| 858 | |
| 859 | func sharedSetup(tsEnv testScriptEnv) func(ts *testscript.Env) error { |
| 860 | return func(ts *testscript.Env) error { |
| 861 | scriptName, ok := extractScriptName(ts.Vars) |
| 862 | if !ok { |
| 863 | ts.T().Fatal("script name not found") |
| 864 | } |
| 865 | |
| 866 | // When using script name to uniquely identify where test data comes from, |
| 867 | // some places like GitHub Actions secret names don't accept hyphens. |
| 868 | // Replace them with underscores until such a time this becomes a problem. |
| 869 | ts.Setenv("SCRIPT_NAME", strings.ReplaceAll(scriptName, "-", "_")) |
| 870 | ts.Setenv("HOME", ts.Cd) |
| 871 | ts.Setenv("GH_CONFIG_DIR", ts.Cd) |
| 872 | |
| 873 | ts.Setenv("GH_HOST", tsEnv.host) |
| 874 | ts.Setenv("ORG", tsEnv.org) |
| 875 | |
| 876 | if tsEnv.apiHost == "" { |
| 877 | ts.Setenv("GH_TOKEN", tsEnv.token) |
| 878 | } else { |
| 879 | // api_host is only readable from hosts.yml, and a GH_TOKEN in the |
| 880 | // environment resolves auth without ever consulting that file, so |
| 881 | // the token has to move into the same place as the override. |
| 882 | hostsFile := filepath.Join(ts.Cd, "hosts.yml") |
| 883 | hostsContent := fmt.Sprintf(""+ |
| 884 | "%[1]s:\n"+ |
| 885 | " user: %[2]s\n"+ |
| 886 | " oauth_token: %[3]s\n"+ |
| 887 | " git_protocol: https\n"+ |
| 888 | " api_host: %[4]s\n"+ |
| 889 | " users:\n"+ |
| 890 | " %[2]s:\n"+ |
| 891 | " oauth_token: %[3]s\n", |
| 892 | tsEnv.host, tsEnv.user, tsEnv.token, tsEnv.apiHost) |
| 893 | if err := os.WriteFile(hostsFile, []byte(hostsContent), 0o600); err != nil { |
| 894 | return fmt.Errorf("writing sandbox hosts.yml: %w", err) |
| 895 | } |
| 896 | } |
| 897 | ts.Setenv("GH_ACCEPTANCE_FIXTURE_MODE", "undeclared") |
| 898 | |
| 899 | ts.Setenv("RANDOM_STRING", randomString(10)) |
| 900 | |
| 901 | ts.Setenv("GH_TELEMETRY", "false") |
| 902 | |
| 903 | // testscript constructs a fresh environment from a fixed allowlist and |
| 904 | // does not propagate SSL_CERT_FILE. When the operator has set it - for |
| 905 | // instance because all API traffic routes through a gateway whose CA is |
| 906 | // not in the system bundle - honour that intent explicitly, or every |
| 907 | // request inside the sandbox will fail certificate verification. |
| 908 | if certFile := os.Getenv("SSL_CERT_FILE"); certFile != "" { |
| 909 | ts.Setenv("SSL_CERT_FILE", certFile) |
| 910 | } |
| 911 | |
| 912 | // The sandbox overrides HOME, so git cannot find the user's global |
| 913 | // config. Write a minimal identity so commits inside the sandbox |
| 914 | // don't fail with "Author identity unknown". |
| 915 | gitCfg := filepath.Join(ts.Cd, ".gitconfig") |
| 916 | gitCfgContent := heredoc.Doc(` |
no test coverage detected