Use external temporary storage for release builds

build_test.go

@@ -520,3 +520,32 @@ func (w *sourceChangeWriter) Write(p []byte) (int, error) {
 	}
 	return len(p), nil
 }
+
+func TestCandidateBuildDoesNotRequireWritableRepositoryParent(t *testing.T) {
+	if runtime.GOOS == "windows" || os.Getuid() == 0 {
+		t.Skip("requires ordinary Unix permission checks")
+	}
+	repository := newBuildConsumer(t, `package main
+import("fmt";"gitea.maximumdirect.net/eric/ReleaseKit/buildinfo")
+func main(){fmt.Println("fixture",buildinfo.Version())}
+`)
+	writeBuildFixture(t, repository, "docs/releases/v1.2.3.md", "# Fixture v1.2.3\n")
+	buildGit(t, repository, "add", "--all")
+	buildGit(t, repository, "commit", "-m", "note")
+	parent := t.TempDir()
+	moved := filepath.Join(parent, "repo")
+	if err := os.Rename(repository, moved); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.Chmod(parent, 0555); err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { os.Chmod(parent, 0700) })
+	_, err := releasekit.Check(context.Background(), releasekit.ReleaseRequest{RepositoryDir: moved, Product: "Fixture", Version: "v1.2.3", Validate: func(context.Context, releasekit.Candidate) error { return nil }, Build: &releasekit.BuildSpec{MainPackage: "./cmd/app", BinaryName: "fixture", Targets: []releasekit.Target{{OS: runtime.GOOS, Arch: runtime.GOARCH}}}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if status := buildGit(t, moved, "status", "--porcelain"); status != "" {
+		t.Fatalf("candidate dirtied: %s", status)
+	}
+}