fix: restore test isolation, and finish the audit's group B

Three tests edited files inside the repository — adapters/nextjs/adapter.env
and common/.editorconfig — backing them up and restoring after. Sequentially
that was safe. Once the suites ran with --jobs they raced the tests that read
those same files, and one left ADAPTER_TIER="Z" in a tracked file. I had
stated that --jobs changed no isolation because bats gives each test its own
process and BATS_TEST_TMPDIR; that is true of temp directories, and these
tests never worked in theirs.

copy_toolbox gives a test that must modify the toolbox its own copy. Verified
by comparing the working tree before and after a run — it is now unchanged,
which is the claim I should have measured the first time rather than asserted.

Also in this commit:
- two php apps each keep their own pre-commit hook. Both fragments define
  , and the merge is key-wise, so one app's php went unformatted.
- install.sh's mv is checked: unchecked, it returned 0 through the trap, so a
  failed write reported success and left the generated password on disk.
- install.sh's cleanup trap now bakes its path in and names the signals. A
  plain EXIT trap on a local does neither, and a Ctrl-C mid-download left the
  password file behind — which the comment beside it claimed it did not.
- the moving-tag suppression comments and ADR-0005 now state what the tag
  costs: a write channel into every generated project that outlives handover
  and revoked access, carrying contents: write and the release app's key.
  ADR-0005 previously mitigated only the accidental case, with a smoke suite
  that cannot detect a deliberate one.

Author: nghiatruongtps

common/.github/workflows/build.yml

@@ -14,10 +14,18 @@ jobs:
     permissions:
       contents: read
       packages: write
-    # This account's own reusable workflow, tracked by a moving major tag on
-    # purpose (ADR-0005) so one fix reaches every project at once. The
-    # third-party actions inside it are still sha-pinned; the trade-off is
-    # scoped to a repository this account controls.
+    # A moving major tag, on purpose (ADR-0005): one fix reaches every project
+    # at once, without a pull request into each. The third-party actions inside
+    # are sha-pinned.
+    #
+    # What that costs, stated plainly because the tag outlives the engagement:
+    # this is a write channel into this repository's CI that survives handover
+    # and any revoked access, and release.yml grants the called workflow
+    # contents: write, packages: write and the release app's private key. One
+    # force-push of the tag reaches every project generated from this toolbox
+    # simultaneously, with no review and no signal here. Accepted, not solved —
+    # sha-pinning with Renovate is the alternative, and it gives up the
+    # one-fix-reaches-everything the tag was chosen for.
     uses: you/.github/.github/workflows/app-build.yml@v1 # zizmor: ignore[unpinned-uses,ref-confusion]
     with:
       image: ghcr.io/you/@PROJECT_NAME@

common/.github/workflows/ci.yml

@@ -15,10 +15,18 @@ jobs:
     permissions:
       contents: read
       pull-requests: read
-    # This account's own reusable workflow, tracked by a moving major tag on
-    # purpose (ADR-0005) so one fix reaches every project at once. The
-    # third-party actions inside it are still sha-pinned; the trade-off is
-    # scoped to a repository this account controls.
+    # A moving major tag, on purpose (ADR-0005): one fix reaches every project
+    # at once, without a pull request into each. The third-party actions inside
+    # are sha-pinned.
+    #
+    # What that costs, stated plainly because the tag outlives the engagement:
+    # this is a write channel into this repository's CI that survives handover
+    # and any revoked access, and release.yml grants the called workflow
+    # contents: write, packages: write and the release app's private key. One
+    # force-push of the tag reaches every project generated from this toolbox
+    # simultaneously, with no review and no signal here. Accepted, not solved —
+    # sha-pinning with Renovate is the alternative, and it gives up the
+    # one-fix-reaches-everything the tag was chosen for.
     uses: you/.github/.github/workflows/app-ci.yml@v1 # zizmor: ignore[unpinned-uses,ref-confusion]
     with:
       roots: '["docs"]'

common/.github/workflows/docs.yml

@@ -11,8 +11,16 @@ jobs:
     # the union of what app-docs's own jobs ask for, and no more.
     permissions:
       contents: read
-    # This account's own reusable workflow, tracked by a moving major tag on
-    # purpose (ADR-0005) so one fix reaches every project at once. The
-    # third-party actions inside it are still sha-pinned; the trade-off is
-    # scoped to a repository this account controls.
+    # A moving major tag, on purpose (ADR-0005): one fix reaches every project
+    # at once, without a pull request into each. The third-party actions inside
+    # are sha-pinned.
+    #
+    # What that costs, stated plainly because the tag outlives the engagement:
+    # this is a write channel into this repository's CI that survives handover
+    # and any revoked access, and release.yml grants the called workflow
+    # contents: write, packages: write and the release app's private key. One
+    # force-push of the tag reaches every project generated from this toolbox
+    # simultaneously, with no review and no signal here. Accepted, not solved —
+    # sha-pinning with Renovate is the alternative, and it gives up the
+    # one-fix-reaches-everything the tag was chosen for.
     uses: you/.github/.github/workflows/app-docs.yml@v1 # zizmor: ignore[unpinned-uses,ref-confusion]

common/.github/workflows/release.yml

@@ -16,10 +16,18 @@ jobs:
       issues: write
       packages: write
       pull-requests: write
-    # This account's own reusable workflow, tracked by a moving major tag on
-    # purpose (ADR-0005) so one fix reaches every project at once. The
-    # third-party actions inside it are still sha-pinned; the trade-off is
-    # scoped to a repository this account controls.
+    # A moving major tag, on purpose (ADR-0005): one fix reaches every project
+    # at once, without a pull request into each. The third-party actions inside
+    # are sha-pinned.
+    #
+    # What that costs, stated plainly because the tag outlives the engagement:
+    # this is a write channel into this repository's CI that survives handover
+    # and any revoked access, and release.yml grants the called workflow
+    # contents: write, packages: write and the release app's private key. One
+    # force-push of the tag reaches every project generated from this toolbox
+    # simultaneously, with no review and no signal here. Accepted, not solved —
+    # sha-pinning with Renovate is the alternative, and it gives up the
+    # one-fix-reaches-everything the tag was chosen for.
     uses: you/.github/.github/workflows/app-release.yml@v1 # zizmor: ignore[unpinned-uses,ref-confusion]
     # release please opens its pull request as a github app when the repository
     # has RELEASE_APP_ID and RELEASE_APP_PRIVATE_KEY, so the checks on that pull

common/.github/workflows/security.yml

@@ -14,8 +14,16 @@ jobs:
     permissions:
       contents: read
       security-events: write
-    # This account's own reusable workflow, tracked by a moving major tag on
-    # purpose (ADR-0005) so one fix reaches every project at once. The
-    # third-party actions inside it are still sha-pinned; the trade-off is
-    # scoped to a repository this account controls.
+    # A moving major tag, on purpose (ADR-0005): one fix reaches every project
+    # at once, without a pull request into each. The third-party actions inside
+    # are sha-pinned.
+    #
+    # What that costs, stated plainly because the tag outlives the engagement:
+    # this is a write channel into this repository's CI that survives handover
+    # and any revoked access, and release.yml grants the called workflow
+    # contents: write, packages: write and the release app's private key. One
+    # force-push of the tag reaches every project generated from this toolbox
+    # simultaneously, with no review and no signal here. Accepted, not solved —
+    # sha-pinning with Renovate is the alternative, and it gives up the
+    # one-fix-reaches-everything the tag was chosen for.
     uses: you/.github/.github/workflows/app-security.yml@v1 # zizmor: ignore[unpinned-uses,ref-confusion]

common/install.sh

@@ -50,19 +50,32 @@ download_release_assets() {
   echo "downloading example.env..."
   local tmp_env
   tmp_env="$(mktemp ./.env.XXXXXX)" || return 1
-  trap 'rm -f "$tmp_env"' EXIT
+  # Two changes from the obvious `trap 'rm -f "$tmp_env"' EXIT`, both needed
+  # before a Ctrl-C stopped leaving the generated password on disk: the path is
+  # baked in with printf %q, because bash unwinds function locals before
+  # running the trap; and the signals are named, because a plain EXIT trap does
+  # not run when one kills the shell.
+  # shellcheck disable=SC2064 # expanding now is the point
+  trap "rm -f $(printf '%q' "$tmp_env")" EXIT INT TERM HUP
   if ! curl -fsSL "${RepoUrl}/example.env" -o "$tmp_env"; then
-    trap - EXIT
+    trap - EXIT INT TERM HUP
     rm -f "$tmp_env"
     return 1
   fi
   if ! generate_database_password "$tmp_env"; then
-    trap - EXIT
+    trap - EXIT INT TERM HUP
     rm -f "$tmp_env"
     return 1
   fi
-  mv "$tmp_env" ./.env
-  trap - EXIT
+  # checked, like every other step here: an unchecked mv returns 0 through the
+  # trap below, so a failure reported success and left the password file behind.
+  if ! mv "$tmp_env" ./.env; then
+    rm -f "$tmp_env"
+    trap - EXIT INT TERM HUP
+    echo "could not write .env" >&2
+    return 1
+  fi
+  trap - EXIT INT TERM HUP
 }
 
 # Fails hard if the substitution misses: a password silently staying

docs/decisions/0005-share-ci-through-reusable-workflows.md

@@ -28,6 +28,15 @@ commit or a fixed minor version.
   Mitigated by running the smoke suite against the workflow repository's
   `main` before moving `v1` to point at it, and by rolling back with a tag
   move rather than a revert-and-redeploy per project.
+- The blast radius of a *deliberate* change is the same, and the smoke suite
+  does not detect one. `v1` is a write channel into every generated project's
+  CI that outlives the engagement: it keeps working after handover, after
+  collaborator access is revoked, and after the client stops working with the
+  account that owns it. `app-release.yml` grants the called workflow
+  `contents: write`, `packages: write` and the release app's private key, so
+  whoever controls the tag controls those in every project at once. Accepted
+  rather than solved. SHA-pinning each call site with Renovate bumping them is
+  the alternative, and it gives up the property this decision was made for.
 - A generated project's own `.github/workflows/` carries no logic to fix
   later — the entire reason for the split. Any logic that did end up there
   would need a per-project patch to change, which is exactly what this

lib/adapter.sh

@@ -54,6 +54,13 @@ merge_lefthook_fragment() {
   rendered="$(mktemp)"
   sed "s|@APP_ROOT@|${rel}/|g" "$fragment" > "$rendered"
 
+  # Suffix every command name with the app it came from. The merge below is
+  # key-wise, so two apps of the same language — both laravel adapters define
+  # `pint` — would otherwise leave one hook scoped to whichever was applied
+  # last, and the other app's code unformatted on commit, silently.
+  yq --inplace "(.. | select(has(\"commands\")) | .commands) |=
+      with_entries(.key |= . + \"-${rel//\//-}\")" "$rendered"
+
   # cleaned up on both paths: under `set -e` a yq failure leaves immediately
   # and the file survives the run. Not a RETURN trap — that fires again in
   # callers, where $rendered is out of scope and the shell aborts.

tests/helpers/setup.bash

@@ -27,3 +27,21 @@ assert_ok() {
     false
   }
 }
+
+# copy_toolbox — a private copy of the toolbox for a test that has to modify
+# it. Two tests need to see how the scripts behave against a broken adapter or
+# a drifted file; editing the real tree made them race each other once the
+# suites started running with --jobs, and one left ADAPTER_TIER="Z" behind in
+# a tracked file. The scripts resolve their own root from their location, so
+# running them out of the copy is enough.
+copy_toolbox() {
+  local dest="${BATS_TEST_TMPDIR}/toolbox"
+  mkdir -p "$dest"
+  cp -R "${SCAFFOLD_ROOT}/adapters" "${SCAFFOLD_ROOT}/lib" \
+        "${SCAFFOLD_ROOT}/scripts" "${SCAFFOLD_ROOT}/common" \
+        "${SCAFFOLD_ROOT}/scaffold" "$dest/"
+  cp "${SCAFFOLD_ROOT}/UPSTREAM" "$dest/" 2>/dev/null || true
+  mkdir -p "$dest/docs"
+  cp "${SCAFFOLD_ROOT}/docs/PROVENANCE.md" "$dest/docs/" 2>/dev/null || true
+  printf '%s' "$dest"
+}

tests/new-laravel-api.bats

@@ -93,3 +93,15 @@ teardown() {
   run mise run //apps/worker:install
   assert_ok
 }
+
+@test "two php apps each keep their own pint hook" {
+  scaffold new "$PROJECT" --api laravel-api --app laravel-inertia
+  # Both fragments define pre-commit.commands.pint, and yq's merge is key-wise,
+  # so the second overwrote the first — one hook survived, scoped to one app,
+  # and the other app's php was never formatted on commit. Silently.
+  run yq -r '.pre-commit.commands | keys | .[]' "${PROJECT}/lefthook.yml"
+  assert_ok
+  local hooks
+  hooks="$(printf '%s\n' "$output" | grep -c pint)"
+  [ "$hooks" -eq 2 ] || { echo "expected 2 pint hooks, found ${hooks}:"; echo "$output"; false; }
+}