fix(ci): support empty flags on Bash 3.2

Author: coderdan

scripts/__tests__/go-binding-test.test.mjs

@@ -0,0 +1,80 @@
+import { spawnSync } from 'node:child_process'
+import {
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  rmSync,
+  writeFileSync,
+} from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { describe, expect, it } from 'vitest'
+import { REPO_ROOT } from './lib/repo-root.mjs'
+
+describe('Go binding script test flags', () => {
+  for (const platform of ['Darwin', 'Linux']) {
+    for (const producer of [false, true]) {
+      it(`${platform}, artifact producer=${producer}`, () => {
+        const root = mkdtempSync(join(tmpdir(), 'go-binding-script-'))
+        try {
+          const bin = join(root, 'bin')
+          const module = join(root, 'module with spaces')
+          const log = join(root, 'commands.log')
+          mkdirSync(bin)
+          mkdirSync(module)
+          writeFileSync(join(module, 'guest.wasm'), 'test guest')
+          writeFileSync(join(bin, 'gofmt'), '#!/bin/sh\nexit 0\n', {
+            mode: 0o755,
+          })
+          writeFileSync(
+            join(bin, 'uname'),
+            `#!/bin/sh\nprintf '%s\\n' '${platform}'\n`,
+            { mode: 0o755 },
+          )
+          writeFileSync(
+            join(bin, 'go'),
+            `#!/bin/sh
+printf '%s|%s|%s\\n' "\${GOOS:-}" "\${GOARCH:-}" "$*" >> "$GO_BINDING_LOG"
+`,
+            { mode: 0o755 },
+          )
+          // /bin/bash is the CI shell, including Bash 3.2 on macOS. Do not
+          // accidentally test only a newer Homebrew shell found on PATH.
+          const result = spawnSync(
+            '/bin/bash',
+            [
+              join(REPO_ROOT, 'scripts/go-binding-test.sh'),
+              module,
+              'guest.wasm',
+            ],
+            {
+              env: {
+                ...process.env,
+                PATH: `${bin}:${process.env.PATH}`,
+                GO_BINDING_LOG: log,
+                GOOS: '',
+                GOARCH: '',
+                STACK_CONFORMANCE_OUTPUT: producer
+                  ? join(root, 'artifact.json')
+                  : '',
+              },
+              encoding: 'utf8',
+            },
+          )
+          expect(result.status, result.stderr).toBe(0)
+          const flags = producer ? '-count=1 ' : ''
+          expect(readFileSync(log, 'utf8').trim().split('\n')).toEqual([
+            '||vet ./...',
+            '||test -v ./auth -run ^TestDeviceRefresh',
+            `||test ${flags}./...`,
+            platform === 'Linux'
+              ? `linux|386|test ${flags}./...`
+              : 'linux|386|vet ./...',
+          ])
+        } finally {
+          rmSync(root, { recursive: true, force: true })
+        }
+      })
+    }
+  }
+})

scripts/__tests__/stack-conformance-ci.test.mjs

@@ -67,8 +67,8 @@ describe('shared Stack Encrypt conformance is required in CI', () => {
       join(REPO_ROOT, 'scripts/go-binding-test.sh'),
       'utf8',
     )
-    expect(goTests).toContain('conformance_flags=(-count=1)')
-    expect(goTests).toMatch(/go test "\$\{conformance_flags\[@\]\}" \.\/\.\.\./)
+    expect(goTests).toContain('set -- -count=1')
+    expect(goTests).toContain('go test "$@" ./...')
     expect(steps[exchange].if).toBeUndefined()
     expect(steps[exchange]['continue-on-error']).toBeUndefined()
   })

scripts/go-binding-test.sh

@@ -41,18 +41,20 @@ go vet ./...
 # independent guest instances sharing one auth.json.
 CGO_ENABLED=0 go test -v ./auth -run '^TestDeviceRefresh'
 # A producer must execute even if Go has cached a previous successful run.
-conformance_flags=()
+# The guest paths have been checked; reuse positional arguments for test flags.
+# Unlike an empty array, "$@" is safe under nounset in macOS's Bash 3.2.
+set --
 if [[ -n "${STACK_CONFORMANCE_OUTPUT:-}" ]]; then
-  conformance_flags=(-count=1)
+  set -- -count=1
 fi
-CGO_ENABLED=0 go test "${conformance_flags[@]}" ./...
+CGO_ENABLED=0 go test "$@" ./...
 
 # The transport codec's u32-bound guards are load-bearing where int is 32
 # bits (vitaminc's vcffi runs this sweep too); the binding's own reflection
 # and buffer arithmetic must hold there as well. Linux hosts execute 386
 # natively; elsewhere the binary cannot run, so only vet.
 if [ "$(uname -s)" = "Linux" ]; then
-  CGO_ENABLED=0 GOOS=linux GOARCH=386 go test "${conformance_flags[@]}" ./...
+  CGO_ENABLED=0 GOOS=linux GOARCH=386 go test "$@" ./...
 else
   CGO_ENABLED=0 GOOS=linux GOARCH=386 go vet ./...
 fi