Write run outputs and diagnostics

internal/core/diagnostics/run_dir.go

@@ -173,7 +173,7 @@ func (r *RunDirectory) WriteErrorLog(errorMessage string) error {
 	if err != nil {
 		return err
 	}
-	if err := os.WriteFile(path, []byte(errorMessage+"\n"), 0o644); err != nil {
+	if err := writeFileAtomic(path, []byte(errorMessage+"\n"), 0o644); err != nil {
 		return fmt.Errorf("write diagnostics artifact %q: %w", ArtifactErrorLog, err)
 	}
 	return nil
@@ -193,7 +193,7 @@ func (r *RunDirectory) WriteJSONArtifact(name string, payload any) error {
 		return fmt.Errorf("marshal diagnostics artifact %q: %w", name, err)
 	}
 	data = append(data, '\n')
-	if err := os.WriteFile(path, data, 0o644); err != nil {
+	if err := writeFileAtomic(path, data, 0o644); err != nil {
 		return fmt.Errorf("write diagnostics artifact %q: %w", name, err)
 	}
 	return nil
@@ -241,3 +241,39 @@ func (r *RunDirectory) artifactPath(name string) (string, error) {
 	}
 	return artifactPath, nil
 }
+
+func writeFileAtomic(path string, data []byte, perm os.FileMode) error {
+	dir := filepath.Dir(path)
+	if err := os.MkdirAll(dir, 0o755); err != nil {
+		return err
+	}
+
+	temp, err := os.CreateTemp(dir, "."+filepath.Base(path)+".tmp-*")
+	if err != nil {
+		return err
+	}
+	tempPath := temp.Name()
+	removeTemp := true
+	defer func() {
+		if removeTemp {
+			_ = os.Remove(tempPath)
+		}
+	}()
+
+	if _, err := temp.Write(data); err != nil {
+		_ = temp.Close()
+		return err
+	}
+	if err := temp.Chmod(perm); err != nil {
+		_ = temp.Close()
+		return err
+	}
+	if err := temp.Close(); err != nil {
+		return err
+	}
+	if err := os.Rename(tempPath, path); err != nil {
+		return err
+	}
+	removeTemp = false
+	return nil
+}

internal/core/diagnostics/run_dir_test.go

@@ -118,6 +118,24 @@ func TestWriteJSONArtifactWritesIndentedNewlineTerminatedJSON(t *testing.T) {
 	}
 }
 
+func TestWriteJSONArtifactLeavesNoTemporaryFiles(t *testing.T) {
+	runDir := newTestRunDirectory(t)
+
+	if err := runDir.WriteJSONArtifact("artifact.json", map[string]any{"value": "ok"}); err != nil {
+		t.Fatalf("WriteJSONArtifact: %v", err)
+	}
+
+	entries, err := os.ReadDir(runDir.Path())
+	if err != nil {
+		t.Fatalf("read run directory: %v", err)
+	}
+	for _, entry := range entries {
+		if strings.Contains(entry.Name(), ".tmp-") {
+			t.Fatalf("temporary diagnostics file remains after success: %s", entry.Name())
+		}
+	}
+}
+
 func TestWriteInvocationMetadataFillsMissingRunIDAndStartTime(t *testing.T) {
 	runDir := newTestRunDirectory(t)