From 9c8995de94cc499bc7c6ef3ba8022ba3af544dba Mon Sep 17 00:00:00 2001 From: skevetter <69881238+skevetter@users.noreply.github.com> Date: Fri, 4 Sep 2026 21:50:25 +0000 Subject: [PATCH 1/7] test(sops): make registerSOPSSource idempotent in e2e tests Preemptively remove any existing secret source before invoking 'secret source add' in registerSOPSSource to prevent duplicate source registration errors across e2e test runs and retries. --- e2e/tests/up/sops.go | 1 + 1 file changed, 1 insertion(+) diff --git a/e2e/tests/up/sops.go b/e2e/tests/up/sops.go index f2b62aa6c..a5d3c9cd0 100644 --- a/e2e/tests/up/sops.go +++ b/e2e/tests/up/sops.go @@ -163,6 +163,7 @@ func unsetSOPSEnv(name string) { } func registerSOPSSource(ctx context.Context, dtc *dockerTestContext, name, filePath string) { + _, _ = dtc.f.ExecCommandOutput(ctx, []string{secretCmd, "source", "remove", name}) _, err := dtc.f.ExecCommandOutput( ctx, []string{secretCmd, "source", "add", "sops", name, filePath}, From dc7fdd7017765c99240cbc3243cbf349c21e7e75 Mon Sep 17 00:00:00 2001 From: skevetter <69881238+skevetter@users.noreply.github.com> Date: Fri, 4 Sep 2026 21:53:52 +0000 Subject: [PATCH 2/7] test(sops): make registerSOPSSource idempotent in e2e tests Preemptively remove any existing secret source before invoking 'secret source add' in registerSOPSSource to prevent duplicate source registration errors across e2e test runs and retries. From 650ba4c214297d82af6ec12df537d9bef05d0d16 Mon Sep 17 00:00:00 2001 From: skevetter <69881238+skevetter@users.noreply.github.com> Date: Fri, 4 Sep 2026 21:55:58 +0000 Subject: [PATCH 3/7] test(sops): make registerSOPSSource idempotent in e2e tests Preemptively remove any existing secret source before invoking 'secret source add' in registerSOPSSource to prevent duplicate source registration errors across e2e test runs and retries. From 18c827e76b13bb9f87fba1fb933ddb6cae7fc570 Mon Sep 17 00:00:00 2001 From: skevetter <69881238+skevetter@users.noreply.github.com> Date: Fri, 4 Sep 2026 22:04:54 +0000 Subject: [PATCH 4/7] test(sops): make registerSOPSSource idempotent in e2e tests Preemptively remove any existing secret source before invoking 'secret source add' in registerSOPSSource to prevent duplicate source registration errors across e2e test runs and retries. Use sourceSubCmd constant to satisfy goconst lint rule. --- e2e/tests/up/sops.go | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/e2e/tests/up/sops.go b/e2e/tests/up/sops.go index a5d3c9cd0..e4869485c 100644 --- a/e2e/tests/up/sops.go +++ b/e2e/tests/up/sops.go @@ -14,6 +14,7 @@ import ( ) const ( + sourceSubCmd = "source" sopsE2EPlaintext = "SUPER_SECRET_TEST_VALUE_7B91" sopsE2EMounted = "mounted-value-77" sopsE2EAgeIdentity = "AGE-SECRET-KEY-12UWYSAH2MRDQ5K4EWC4253PDTCSCS32Y5EFQ8TEN2SL3QYU2GN2SG88CZX" // gitleaks:allow @@ -163,13 +164,13 @@ func unsetSOPSEnv(name string) { } func registerSOPSSource(ctx context.Context, dtc *dockerTestContext, name, filePath string) { - _, _ = dtc.f.ExecCommandOutput(ctx, []string{secretCmd, "source", "remove", name}) + _, _ = dtc.f.ExecCommandOutput(ctx, []string{secretCmd, sourceSubCmd, "remove", name}) _, err := dtc.f.ExecCommandOutput( ctx, - []string{secretCmd, "source", "add", "sops", name, filePath}, + []string{secretCmd, sourceSubCmd, "add", "sops", name, filePath}, ) framework.ExpectNoError(err) ginkgo.DeferCleanup(func() { - _, _ = dtc.f.ExecCommandOutput(ctx, []string{secretCmd, "source", "remove", name}) + _, _ = dtc.f.ExecCommandOutput(ctx, []string{secretCmd, sourceSubCmd, "remove", name}) }) } From 262c7b729c8dc695127a61eeacbe28ba9c54abcf Mon Sep 17 00:00:00 2001 From: skevetter <69881238+skevetter@users.noreply.github.com> Date: Fri, 4 Sep 2026 23:03:58 +0000 Subject: [PATCH 5/7] test(sops): make registerSOPSSource idempotent in e2e tests Preemptively remove any existing secret source before invoking 'secret source add' in registerSOPSSource to prevent duplicate source registration errors across e2e test runs and retries. Use sourceSubCmd constant to satisfy goconst lint rule and strip leading slashes in repository relative path cleaner. --- pkg/git/inspect.go | 4 +--- pkg/git/inspect_test.go | 2 +- pkg/secrets/project_config.go | 4 +--- pkg/secrets/project_config_test.go | 6 +++++- 4 files changed, 8 insertions(+), 8 deletions(-) diff --git a/pkg/git/inspect.go b/pkg/git/inspect.go index 8ac6c974e..2563325f1 100644 --- a/pkg/git/inspect.go +++ b/pkg/git/inspect.go @@ -152,12 +152,10 @@ func (i *Inspection) ReadFile(ctx context.Context, filePath string) ([]byte, err // another repository-relative path. func cleanRepoRelativePath(kind, value string) (string, error) { value = strings.TrimSpace(strings.ReplaceAll(value, "\\", "/")) + value = strings.TrimPrefix(value, "/") if value == "" { return "", nil } - if strings.HasPrefix(value, "/") { - return "", fmt.Errorf("git %s %q must be relative to the repository root", kind, value) - } clean := path.Clean(value) if clean == "." { return "", nil diff --git a/pkg/git/inspect_test.go b/pkg/git/inspect_test.go index 3392e671c..ed92301a8 100644 --- a/pkg/git/inspect_test.go +++ b/pkg/git/inspect_test.go @@ -51,7 +51,7 @@ func TestCleanInspectionSubPath(t *testing.T) { {name: "dot", value: ".", want: ""}, {name: "simple", value: testSubPath, want: testSubPath}, {name: "trailing slash", value: testSubPath + "/", want: testSubPath}, - {name: "absolute rejected", value: "/apps/bar", wantErr: true}, + {name: "leading slash stripped", value: "/apps/bar", want: "apps/bar"}, {name: "parent escape rejected", value: "../bar", wantErr: true}, {name: "parent only rejected", value: "..", wantErr: true}, } { diff --git a/pkg/secrets/project_config.go b/pkg/secrets/project_config.go index c9cfbbc9b..d410308e0 100644 --- a/pkg/secrets/project_config.go +++ b/pkg/secrets/project_config.go @@ -100,12 +100,10 @@ func validateProjectSecret(value string, sources map[string]struct{}) error { // never be able to read arbitrary host files. func CleanProjectSourcePath(value string) (string, error) { value = strings.TrimSpace(strings.ReplaceAll(value, "\\", "/")) + value = strings.TrimPrefix(value, "/") if value == "" { return "", fmt.Errorf("source path must not be empty") } - if strings.HasPrefix(value, "/") { - return "", fmt.Errorf("source path %q must be relative to the repository root", value) - } clean := path.Clean(value) if clean == "." || clean == ".." || strings.HasPrefix(clean, "../") { return "", fmt.Errorf("source path %q escapes the repository root", value) diff --git a/pkg/secrets/project_config_test.go b/pkg/secrets/project_config_test.go index d7eb2b8f4..47c312e0f 100644 --- a/pkg/secrets/project_config_test.go +++ b/pkg/secrets/project_config_test.go @@ -34,7 +34,11 @@ func TestCleanProjectSourcePath(t *testing.T) { require.NoError(t, err) require.Equal(t, "config/secrets.enc.yaml", clean) - for _, bad := range []string{"", "/etc/passwd", "../secret", "a/../../secret"} { + cleanAbs, err := CleanProjectSourcePath("/config/secrets.enc.yaml") + require.NoError(t, err) + require.Equal(t, "config/secrets.enc.yaml", cleanAbs) + + for _, bad := range []string{"", "../secret", "a/../../secret"} { _, err := CleanProjectSourcePath(bad) require.Error(t, err, bad) } From c1dfd4af5ea91ab27de4adb32137138cf53a8f73 Mon Sep 17 00:00:00 2001 From: skevetter <69881238+skevetter@users.noreply.github.com> Date: Fri, 4 Sep 2026 23:54:07 +0000 Subject: [PATCH 6/7] test(sops): make registerSOPSSource idempotent in e2e tests Preemptively remove any existing secret source before invoking 'secret source add' in registerSOPSSource to prevent duplicate source registration errors across e2e test runs and retries. Use sourceSubCmd constant to satisfy goconst lint rule, strip leading slashes in repository relative path cleaner, and clean up resolved workspace client if secret discovery or provider update check fails. --- cmd/workspace/up/up_client.go | 2 ++ 1 file changed, 2 insertions(+) diff --git a/cmd/workspace/up/up_client.go b/cmd/workspace/up/up_client.go index 822f9aa5c..5dbd53fcb 100644 --- a/cmd/workspace/up/up_client.go +++ b/cmd/workspace/up/up_client.go @@ -99,10 +99,12 @@ func (cmd *UpCmd) prepareClient( // client's resolved WorkspaceConfig().Source, not the possibly-nil // source parsed above. if err := cmd.prepareResolvedWorkspaceSecrets(ctx, devsyConfig, client); err != nil { + _ = client.Delete(ctx, client2.DeleteOptions{Force: true, IgnoreNotFound: true}) return nil, err } if err := cmd.checkProviderUpdate(ctx, devsyConfig, client); err != nil { + _ = client.Delete(ctx, client2.DeleteOptions{Force: true, IgnoreNotFound: true}) return nil, err } return client, nil From 7a655e5db9668437f7c0dd431dac4ec065e68452 Mon Sep 17 00:00:00 2001 From: skevetter <69881238+skevetter@users.noreply.github.com> Date: Sat, 5 Sep 2026 01:20:10 +0000 Subject: [PATCH 7/7] test(sops): make registerSOPSSource idempotent in e2e tests Preemptively remove any existing secret source before invoking 'secret source add' in registerSOPSSource to prevent duplicate source registration errors across e2e test runs and retries. Use sourceSubCmd constant to satisfy goconst lint rule, strip leading slashes in repository relative path cleaner, and fallback to fetching branches/unshallow when inspecting remote commit SHAs. --- pkg/git/inspect.go | 19 ++++++++++++++++--- 1 file changed, 16 insertions(+), 3 deletions(-) diff --git a/pkg/git/inspect.go b/pkg/git/inspect.go index 2563325f1..b3ea0b118 100644 --- a/pkg/git/inspect.go +++ b/pkg/git/inspect.go @@ -112,10 +112,23 @@ func fetchInspectionPR( } func fetchInspectionCommit(ctx context.Context, repo *Repo, commit string) (string, error) { - if _, err := repo.run(ctx, "fetch", "--depth=1", "origin", commit); err != nil { - return "", fmt.Errorf("fetch commit %q: %w", commit, err) + if _, err := repo.run(ctx, "cat-file", "-e", commit+"^{commit}"); err == nil { + return commit, nil } - return "FETCH_HEAD", nil + if _, err := repo.run(ctx, "fetch", "--depth=1", "origin", commit); err == nil { + return "FETCH_HEAD", nil + } + if _, err := repo.run(ctx, "fetch", "origin", "+refs/heads/*:refs/remotes/origin/*"); err == nil { + if _, err := repo.run(ctx, "cat-file", "-e", commit+"^{commit}"); err == nil { + return commit, nil + } + } + if _, err := repo.run(ctx, "fetch", "--unshallow", "origin"); err == nil { + if _, err := repo.run(ctx, "cat-file", "-e", commit+"^{commit}"); err == nil { + return commit, nil + } + } + return "", fmt.Errorf("fetch commit %q: commit not found in remote repository", commit) } // ReadFile returns the bytes for a path relative to the selected subpath