Repository navigation
fix(plugins): nself-ci signer cli children get NSELF_V15=1 (D-1236) - #394
Conversation
f06321b to
e1b66b9
Compare
The exec funnel allowlists the child environment, so the signer's config secrets resolve and set calls ran without NSELF_V15 and failed on cli 1.4.x with E717. ExecRunner gains a base Env; the signer's resolver and key store pass NSELF_V15=1.
2b48735 to
863e9b9
Compare
|
Rebased onto current origin/main to clear the merge conflict (PR was DIRTY, 76 commits behind). The branch carried 8 extra commits of CI-gate repairs (cache/sbom file splits, Android and file-size gates, agent cancellation, process-start guards, fixture fixes) beyond the two D-1236 commits. Main has since landed its own versions of the same splits and gate fixes, and they conflicted file by file (replaying them produced duplicate declarations). I dropped them so this PR is back to its debt row: the two D-1236 commits only (signer cli children get NSELF_V15=1, plus the key store test). Previous head 2b48735 is still reachable if any of those 8 are wanted as a separate PR. Checks (go, -mod=vendor, whole free/ci module): build, vet and gofmt clean. TestSignerResolverChildSeesV15 and TestSignerStoreChildSeesV15 fail against the base source (E675 / missing V15 env) and pass with the fix. Full module run: one failure, internal/legacy TestSecretsEnvLiveKeyGateTrackedValueOnly, which fails identically on plain origin/main. |
The exec funnel allowlists the child environment, so the signer's
config secrets resolveandsetcalls ran without NSELF_V15 and failed on cli 1.4.x with E717.secrets.ExecRunnergains a baseEnvadded to every call.NSELF_V15=1.TestSignerResolverChildSeesV15runs the resolver against a fake cli that gates resolve like 1.4.x; it fails without the fix (E675) and passes with it.Closes debt row D-1236.