Exclude Codebox control files from publication snapshots (#1848)

Author: chubes4

packages/runtime-core/src/runner-workspace-apply.ts

@@ -236,7 +236,9 @@ function validatePatchPaths(patch: string, changed: RunnerWorkspaceChangedFile[]
 async function snapshotWorkspace(root: string): Promise<RunnerWorkspacePublicationFile[]> {
   const output: RunnerWorkspacePublicationFile[] = []
   const { stdout } = await execFileAsync("git", ["ls-files", "--cached", "--others", "--exclude-standard", "-z"], { cwd: root, maxBuffer: MAX_PATCH_BYTES })
-  const paths = stdout.split("\0").filter(Boolean).sort((left, right) => left.localeCompare(right))
+  const paths = stdout.split("\0")
+    .filter((path) => path && path !== ".codebox" && !path.startsWith(".codebox/"))
+    .sort((left, right) => left.localeCompare(right))
   for (const path of paths) {
     const absolute = resolve(root, path)
     if (!pathIsWithinRoot(absolute, root)) throw new Error(`Runner workspace contains a denied path: ${path}`)

tests/runner-workspace-apply.test.ts

@@ -130,6 +130,24 @@ const files = [{ path: "/workspace/README.md", relativePath: "README.md", status
   await verifyRunnerWorkspaceIntegrity(result.integrity!)
 }
 
+{
+  const input = await fixture(patch, files)
+  const controlDirectory = join(input.workspace, ".codebox")
+  await mkdir(controlDirectory)
+  await writeFile(join(controlDirectory, "request.json"), "before\n")
+  const result = await applyRunnerWorkspacePatch({
+    artifactRoot: input.artifacts,
+    artifactRefs: input.refs,
+    workspaceRoot: input.workspace,
+    writablePaths: ["README.md"],
+    verify: async () => {
+      await writeFile(join(controlDirectory, "request.json"), "after\n")
+      await writeFile(join(controlDirectory, "result.json"), "complete\n")
+    },
+  })
+  await verifyRunnerWorkspaceIntegrity(result.integrity!)
+}
+
 {
   const input = await fixture(patch, files)
   await symlink(input.artifacts, join(input.workspace, "publishable-link"))