From 1ff4ced0e197585392bf15d750e6bd729fa722a5 Mon Sep 17 00:00:00 2001 From: atlas Date: Sun, 4 Oct 2026 08:11:57 +0200 Subject: [PATCH] swarm-controller: guard the agent-identity test that can reach the live store `mint_agent_identity_node_runs_end_to_end_and_fails_without_the_agent_pki_named` runs a `MintAgentIdentity` node, which calls `store::connect()` directly rather than through `AppState`. It stops before that login only while `SWARM_CONTROLLER_AGENT_PKI_MOUNT` and `SWARM_CONTROLLER_AGENT_PKI_ROLE` are unset; with both set and `BAO_*` set it reaches a real store. The test now refuses to run with them set. It still runs with `BAO_*` set, since without the agent PKI it never gets as far as the login. --- swarm-controller/src/main.rs | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/swarm-controller/src/main.rs b/swarm-controller/src/main.rs index 51b2f384..80339b53 100644 --- a/swarm-controller/src/main.rs +++ b/swarm-controller/src/main.rs @@ -4091,6 +4091,16 @@ mod tests { /// variable, and creates the agent anyway. #[tokio::test] async fn mint_agent_identity_node_runs_end_to_end_and_fails_without_the_agent_pki_named() { + let pki = [ + crate::agent_identity::ENV_AGENT_PKI_MOUNT, + crate::agent_identity::ENV_AGENT_PKI_ROLE, + ]; + assert!( + pki.iter().all(|var| std::env::var_os(var).is_none()), + "{} and {} must be unset: with them set this test would reach a live store", + pki[0], + pki[1] + ); let mut sched = hive_jobq::scheduler::Scheduler::new( hive_jobq::Graph::new(), hive_jobq::resources::ResourceTable::new(),