Function TestApplyRestoresBinaryWhenPromoteFails

internal/update/update_test.go:114–147

TestApplyRestoresBinaryWhenPromoteFails covers the most dangerous failure: the running binary is moved aside to execPath+".old", then the promote rename fails. Without the restore the user is left with NO executable at execPath. Driven through the promoteRename seam (the one step we can't make fail

(t *testing.T)

// fail deterministically and root-safely via the filesystem); the restore
// uses real os.Rename, so this asserts recovery actually happens.
func TestApplyRestoresBinaryWhenPromoteFails(t *testing.T) {
	asset := platformAsset(t)
	body := []byte("verified new binary\n")
	r := newFakeRelease(t, asset, body, hashOf(body))
	withReleaseURLs(t, r.srv.URL)

	orig := promoteRename
	promoteRename = func(string, string) error { return fmt.Errorf("simulated promote failure") }
	t.Cleanup(func() { promoteRename = orig })

	tmpDir := t.TempDir()
	exec := filepath.Join(tmpDir, "codehamr")
	const originalBytes = "the original running binary\n"
	if err := os.WriteFile(exec, []byte(originalBytes), 0o755); err != nil {
		t.Fatal(err)
	}

	err := Apply(context.Background(), exec)
	if err == nil {
		t.Fatal("Apply must surface the promote failure")
	}
	// The original binary must be restored from .old, not left missing.
	got, readErr := os.ReadFile(exec)
	if readErr != nil {
		t.Fatalf("execPath is gone after a failed promote - user left with no binary: %v", readErr)
	}
	if string(got) != originalBytes {
		t.Fatalf("execPath not restored to the original binary: got %q", got)
	}
	// No half-written temp file should leak.
	if matches, _ := filepath.Glob(filepath.Join(tmpDir, ".codehamr-update-*")); len(matches) != 0 {
		t.Fatalf("temp file leaked after failed promote: %+v", matches)
	}
}

// TestApplyReportsRestoreFailure covers the doubly-bad path: the promote
// rename fails AND the restore of the moved-aside binary also fails. Apply