From 0268e059b7d78697bd45e360a9a89b71533de138 Mon Sep 17 00:00:00 2001
From: fullsend-code
 <278716306+fullsend-ai-coder[bot]@users.noreply.github.com>
Date: Mon, 8 Jun 2026 09:34:46 +0000
Subject: [PATCH] fix(#2002): mock HTTP server in
 TestResolveLinuxBinary_Download
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Replace live GitHub CDN calls in TestResolveLinuxBinary_Download with
an httptest.Server serving mock checksums.txt and tarball data. This
eliminates the external network dependency that caused merge queue
ejections during GitHub CDN outages (e.g., the June 8 incident
affecting PRs #1238, #1239, #1468, #1531, #1905).

The refactored test follows the same pattern already used by
TestDownloadReleaseBinary_ChecksumMatch and
TestDownloadReleaseBinary_ChecksumMismatch in the same file:
build a tar.gz with mock content, compute its SHA256, serve both
via httptest, and override the package-level releaseBaseURL var.

The ELF validation assertion was removed since the mock binary is
not a real ELF — validateLinuxBinary is independently tested by
TestValidateLinuxBinary_* tests elsewhere in the file.

Note: Go tests could not run in the sandbox (requires Go 1.26.0,
sandbox has Go 1.24.13). The change is syntactically valid (gofmt
passes) and follows the exact pattern of adjacent passing tests.
Manual verification of go test is required.

Closes #2002
---
 internal/cli/run_test.go | 48 ++++++++++++++++++++++++++++++++++------
 1 file changed, 41 insertions(+), 7 deletions(-)

diff --git a/internal/cli/run_test.go b/internal/cli/run_test.go
index 4f14a9c150..565199709a 100644
--- a/internal/cli/run_test.go
+++ b/internal/cli/run_test.go
@@ -564,22 +564,56 @@ func TestCrossCompileFullsend_ProducesBinary(t *testing.T) {
 }
 
 func TestResolveLinuxBinary_Download(t *testing.T) {
-	if testing.Short() {
-		t.Skip("skipping download test in short mode")
-	}
+	// Build a valid tar.gz containing a mock "fullsend" binary.
+	var tarBuf bytes.Buffer
+	gw := gzip.NewWriter(&tarBuf)
+	tw := tar.NewWriter(gw)
+	content := []byte("mock fullsend binary")
+	require.NoError(t, tw.WriteHeader(&tar.Header{
+		Name:     "fullsend",
+		Size:     int64(len(content)),
+		Mode:     0o755,
+		Typeflag: tar.TypeReg,
+	}))
+	_, err := tw.Write(content)
+	require.NoError(t, err)
+	require.NoError(t, tw.Close())
+	require.NoError(t, gw.Close())
+
+	tarBytes := tarBuf.Bytes()
+	h := sha256.Sum256(tarBytes)
+	correctHash := hex.EncodeToString(h[:])
+
+	checksumBody := fmt.Sprintf("%s  fullsend_0.4.0_linux_amd64.tar.gz\n", correctHash)
+
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.URL.Path {
+		case "/v0.4.0/checksums.txt":
+			fmt.Fprint(w, checksumBody)
+		case "/v0.4.0/fullsend_0.4.0_linux_amd64.tar.gz":
+			w.Write(tarBytes)
+		default:
+			http.NotFound(w, r)
+		}
+	}))
+	defer srv.Close()
+
+	origBaseURL := releaseBaseURL
+	releaseBaseURL = srv.URL
+	defer func() { releaseBaseURL = origBaseURL }()
 
 	tmpDir := t.TempDir()
 	binPath := filepath.Join(tmpDir, "fullsend")
-	err := downloadReleaseBinary("0.4.0", "amd64", binPath)
+	err = downloadReleaseBinary("0.4.0", "amd64", binPath)
 	require.NoError(t, err)
 
 	info, err := os.Stat(binPath)
 	require.NoError(t, err)
 	assert.True(t, info.Size() > 0, "downloaded binary should be non-empty")
 
-	// Verify the downloaded artifact is a valid Linux ELF for the requested arch.
-	t.Setenv("FULLSEND_SANDBOX_ARCH", "amd64")
-	assert.NoError(t, validateLinuxBinary(binPath), "downloaded binary should be a valid Linux/amd64 ELF")
+	data, err := os.ReadFile(binPath)
+	require.NoError(t, err)
+	assert.Equal(t, "mock fullsend binary", string(data))
 }
 
 func TestReadOIDCAuthFile_Success(t *testing.T) {