From 813c2b68375c91330971d3ea462e4e1fcc2e2cea Mon Sep 17 00:00:00 2001
From: rcourtman <8825017+rcourtman@users.noreply.github.com>
Date: Tue, 1 Sep 2026 22:33:00 +0100
Subject: [PATCH] Match CI temp layout in the preflight worker and isolate
 agent helper tests

go test places t.TempDir under GOTMPDIR, and the preflight worker nested that
under its per-run directory, so unix socket fixtures in cmd/pulse-agent-helper,
internal/agenthelper, and internal/dockeragent exceeded the 108-byte sun_path
limit and failed with "bind: invalid argument". GitHub runners leave GOTMPDIR
unset, and the longest rootless Podman fixture sits exactly at the limit under
/tmp, so the worker now leaves GOTMPDIR unset by default and only honours an
explicit PULSE_RELEASE_PREFLIGHT_GO_TMP_DIR override.

Two cmd/pulse-agent helper tests ran without a state directory, so the agent
consulted the platform default /var/lib/pulse-agent. On a host where that
path exists as a private directory the pending-update handoff lookup fails
with permission denied. Give those tests an isolated state directory.
---
 cmd/pulse-agent/main_test.go        |  2 ++
 scripts/release-preflight-worker.sh | 18 ++++++++++++++----
 2 files changed, 16 insertions(+), 4 deletions(-)

diff --git a/cmd/pulse-agent/main_test.go b/cmd/pulse-agent/main_test.go
index 2c3a5ea50..b2612d18a 100644
--- a/cmd/pulse-agent/main_test.go
+++ b/cmd/pulse-agent/main_test.go
@@ -1779,6 +1779,7 @@ func TestRunConfiguresTypedPrivilegeHelperFromInstallerEnvironment(t *testing.T)
 		"-enable-docker=false",
 		"-enable-kubernetes=false",
 		"-health-addr", "",
+		"-state-dir", t.TempDir(),
 	}, func(string) string { return "" })
 	if err != nil && !errors.Is(err, context.Canceled) && !errors.Is(err, context.DeadlineExceeded) {
 		t.Fatalf("run returned error: %v", err)
@@ -1839,6 +1840,7 @@ func TestRunRejectsUnhealthyTypedPrivilegeHelper(t *testing.T) {
 		"-enable-docker=false",
 		"-enable-kubernetes=false",
 		"-health-addr", "",
+		"-state-dir", t.TempDir(),
 	}, func(string) string { return "" })
 	if err == nil || !strings.Contains(err.Error(), "verify typed privilege helper protocol") {
 		t.Fatalf("run error = %v", err)
diff --git a/scripts/release-preflight-worker.sh b/scripts/release-preflight-worker.sh
index b559aae92..36e523560 100755
--- a/scripts/release-preflight-worker.sh
+++ b/scripts/release-preflight-worker.sh
@@ -35,7 +35,13 @@ CACHE_DIR="${WORKER_ROOT}/cache"
 RECEIPT_DIR="${WORKER_ROOT}/receipts"
 RUN_ID="$(date -u +%Y%m%dT%H%M%SZ)-${SOURCE_SHA:0:12}-${PROFILE}"
 RUN_DIR="${WORKER_ROOT}/tmp/${RUN_ID}"
-GO_TMP_DIR="${RUN_DIR}/go-tmp"
+# Go places test temp directories under GOTMPDIR, and several packages bind
+# unix sockets under t.TempDir at the 108-byte sun_path limit. GitHub runners
+# leave GOTMPDIR unset so those fixtures resolve under /tmp; the worker must
+# match that layout exactly or the socket tests fail with "bind: invalid
+# argument". Set PULSE_RELEASE_PREFLIGHT_GO_TMP_DIR only for a deliberately
+# isolated, equally short directory.
+GO_TMP_DIR="${PULSE_RELEASE_PREFLIGHT_GO_TMP_DIR:-}"
 TIMINGS_FILE="${RUN_DIR}/timings.tsv"
 TEST_DATA_DIR="${WORKER_ROOT}/test-data/${PROFILE}"
 
@@ -67,7 +73,6 @@ mkdir -p \
   "$CACHE_DIR/npm" \
   "$RECEIPT_DIR" \
   "$RUN_DIR" \
-  "$GO_TMP_DIR" \
   "$(dirname "$TEST_DATA_DIR")"
 
 exec 9>"${WORKER_ROOT}/worker.lock"
@@ -83,7 +88,10 @@ unset GH_TOKEN GITHUB_TOKEN PULSE_LICENSE_PRIVATE_KEY PULSE_UPDATE_SIGNING_KEY
 
 export GOCACHE="$CACHE_DIR/go-build"
 export GOMODCACHE="$CACHE_DIR/go-mod"
-export GOTMPDIR="$GO_TMP_DIR"
+if [ -n "$GO_TMP_DIR" ]; then
+  mkdir -p "$GO_TMP_DIR"
+  export GOTMPDIR="$GO_TMP_DIR"
+fi
 export npm_config_cache="$CACHE_DIR/npm"
 # Match the canonical workflow's isolated single-repository checkout. Tests
 # that explicitly require private sibling repositories use this signal to
@@ -105,7 +113,9 @@ phase() {
 }
 
 cleanup() {
-  rm -rf "$GO_TMP_DIR"
+  if [ -n "$GO_TMP_DIR" ]; then
+    rm -rf "$GO_TMP_DIR"
+  fi
   if [ -d "$REPOSITORY_DIR/tests/integration" ]; then
     (
       cd "$REPOSITORY_DIR/tests/integration"