Use external temporary storage for release builds

cmd/releasekit/main_test.go

@@ -762,3 +762,33 @@ func main(){fmt.Println("fixture",buildinfo.Version())}
 		t.Fatalf("stale receipt remains: %v", err)
 	}
 }
+
+func TestTemporaryDeliveryBuildDoesNotRequireWritableRepositoryParent(t *testing.T) {
+	if runtime.GOOS == "windows" || os.Getuid() == 0 {
+		t.Skip("requires ordinary Unix permission checks")
+	}
+	repository := newDeliveryBuildRepository(t)
+	state := &deliveryServerState{}
+	server := newDeliveryServer(t, state)
+	defer server.Close()
+	writeDeliveryProfile(t, repository, cli.Settings{Product: "Example Product", Build: &cli.BuildSettings{MainPackage: ".", BinaryName: "helper", Targets: []string{"linux/amd64"}}, Delivery: &cli.DeliverySettings{BaseURL: server.URL, Owner: "owner", Repository: "example"}})
+	state.commit = cliGitOutput(t, repository, "rev-parse", "HEAD")
+	cliGitRun(t, repository, "tag", "v1.2.3")
+	parent := t.TempDir()
+	moved := filepath.Join(parent, "repo")
+	if err := os.Rename(repository, moved); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.Chmod(parent, 0555); err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { os.Chmod(parent, 0700) })
+	t.Setenv("RELEASEKIT_GITEA_TOKEN", "fixture-token")
+	var stdout, stderr bytes.Buffer
+	if status := run(context.Background(), []string{"deliver", "--repo", moved, "v1.2.3"}, &stdout, &stderr); status != 0 {
+		t.Fatalf("status=%d %s", status, stderr.String())
+	}
+	if status := cliGitOutput(t, moved, "status", "--porcelain"); status != "" {
+		t.Fatalf("source dirtied: %s", status)
+	}
+}