Break-glass merge PR #2669

Author: DeusData

.github/workflows/_smoke.yml

@@ -95,6 +95,13 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
+      # SMOKE_REQUIRE_WRAPPERS=1 needs a Go toolchain for the Go wrapper; the
+      # macOS runner images have none on PATH.
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version-file: pkg/go/go.mod
+          cache: false
+
       - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: binaries-${{ matrix.goos }}-${{ matrix.goarch }}
@@ -176,6 +183,13 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
+      # SMOKE_REQUIRE_WRAPPERS=1 needs a Go toolchain for the Go wrapper; the
+      # MSYS2 shell below inherits it (path-type: inherit).
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version-file: pkg/go/go.mod
+          cache: false
+
       - uses: msys2/setup-msys2@66cd2cce69caa17b53920067426061ca1de3a884 # v2
         with:
           msystem: ${{ matrix.arch == 'arm64' && 'CLANGARM64' || 'CLANG64' }}
@@ -281,6 +295,12 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
+      # SMOKE_REQUIRE_WRAPPERS=1 needs a Go toolchain for the Go wrapper.
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version-file: pkg/go/go.mod
+          cache: false
+
       - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: binaries-linux-${{ matrix.arch }}-portable

.github/workflows/pr.yml

@@ -190,6 +190,13 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
+      # SMOKE_REQUIRE_WRAPPERS=1 needs a Go toolchain for the Go wrapper; the
+      # macOS runner images have none on PATH.
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version-file: pkg/go/go.mod
+          cache: false
+
       - name: Install deps (Ubuntu)
         if: matrix.os == 'ubuntu-latest'
         run: sudo apt-get update && sudo apt-get install -y zlib1g-dev ccache

scripts/smoke-wrappers.sh

@@ -29,9 +29,11 @@ REQUIRE="${SMOKE_REQUIRE_WRAPPERS:-0}"
 EXE=""
 case "${OSTYPE:-}" in msys* | cygwin* | win32*) EXE=".exe" ;; esac
 
-WORK="${TMPDIR:-/tmp}/cbm-smoke-wrappers.$$.$RANDOM"
-mkdir -m 700 "$WORK"
-trap 'rm -rf "$WORK"' EXIT
+# mktemp -d sets 0700 at creation. `mkdir -m 700` changes the mode in a second
+# step, which MSYS2 cannot do under the smoke profile's owner-only DACL.
+WORK="$(mktemp -d "${TMPDIR:-/tmp}/cbm-smoke-wrappers.XXXXXX")"
+# Go writes its module cache read-only; restore write permission so it can be removed.
+trap 'chmod -R u+w "$WORK" 2>/dev/null; rm -rf "$WORK"' EXIT
 FAILED=0
 
 missing() { # wrapper, what
@@ -127,7 +129,11 @@ smoke_go() {
     fi
     local dir="$WORK/go" rc=0
     mkdir -p "$dir"
+    # All Go state stays under $WORK: a toolchain that GOTOOLCHAIN=auto downloads
+    # lands read-only in the module cache, which must not end up in the caller's
+    # HOME (the smoke harness could not delete its profile afterwards).
     (cd "$ROOT/pkg/go" && GOTOOLCHAIN="${GOTOOLCHAIN:-auto}" \
+        GOPATH="$dir/gopath" GOMODCACHE="$dir/gomodcache" GOCACHE="$dir/gocache" \
         go build -o "$dir/codebase-memory-mcp$EXE" ./cmd/codebase-memory-mcp) \
         >"$dir/install.log" 2>&1 || rc=$?
     if [ "$rc" -ne 0 ]; then