[M3gA-Mind]

Summary

Test-only. The behaviour is correct, but nothing exercised it: when a downloaded release archive does not hash to the digest in the release's checksum manifest, acquire_cached must refuse it and leave neither a cache directory nor .staging-* debris behind. Every existing acquire_cached test stops before the network, so the download → verify → clean-up path had no coverage.

Change

• A test-only seam in cache::release_download_url: under #[cfg(test)] a thread-local TEST_RELEASE_BASE can replace https://github.com, so a test can point one thread's downloads at a local server. Release builds are unchanged (#[cfg(not(test))] keeps the constant).
• New test a_download_that_disagrees_with_its_manifest_is_refused_and_cleaned_up: a local server serves a checksum.toml pinning one digest and an archive with other bytes. The test asserts the "does not match its checksum manifest" refusal, no cache directory, and no staging debris.

The REST-listing fallback (a 404 on the direct path) still has no test; it would need the API base routed through the same seam.

Validation

cargo test -p tinybus --features modules --lib -- a_download_that_disagrees_with_its_manifest_is_refused_and_cleaned_up:

	result
main as is	passed
deliberate break: verify_archive call removed from acquire_cached	FAILED: the download went on to extraction ("release archive is invalid") instead of the checksum refusal

Behaviour change

None. Test code and a #[cfg(test)] seam only.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 05e038fe-1f81-47f1-8196-71848915f17f

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[tinysweeper]

Tiny Sweeper review

Reviewed head: f1a66bdb6c51a14c1c599bdb04618d8985024540

Findings

No active actionable findings.

Advisory notes

• medium: Restore the thread-local release base after the test (crates/tinybus/src/module/github_tests.rs:501)
  Problem: `TEST_RELEASE_BASE` is a thread-local that is set to `Some(base)` and never reset. Rust's default test harness runs multiple tests per thread, so any later test on the same thread
  Suggested fix:

      cache::TEST_RELEASE_BASE.with(|slot| *slot.borrow_mut() = Some(base));
      struct Reset;
      impl Drop for Reset {
          fn drop(&mut self) {
              cache::TEST_RELEASE_BASE.with(|slot| *slot.borrow_mut() = None);
          }
      }
      let _reset = Reset;
  

Verdict: Ready for maintainer review · Priority: none
Coverage: Reviewed 2 of 2 files.

Diagnostics and supporting details

Full summary

Pull request purpose (title): test(module): drive a download whose bytes disagree with the manifest. Purpose (title): test(module): drive a download whose bytes disagree with the manifest. This test-only pull request adds a `#[cfg(test)]` seam in `release_download_url` that lets one thread redirect release downloads to a local server, plus a new test that drives a real download through verification and asserts checksum-mismatching bytes are refused with no cache directory and no staging debris. The latest-push delta is unavailable, so no separate delta analysis is presented.

Review snapshot

Change surface	Files	Review signal	Count
Production	1	Active findings	0
Tests	1	Noted findings	1
Documentation	0	Resolved findings	0
Configuration	0	Pending checks/questions	0

Completeness: Complete
Test assessment: No supported feature-to-test mapping was available; this does not mean tests are absent or passed.

What changed

Under `#[cfg(test)]`, `release_download_url` reads a thread-local `TEST_RELEASE_BASE` to substitute the base for one thread's release downloads, falling back to `https://github.com`; under `#[cfg(not(test))]` the base remains the fixed constant, so release behavior is unchanged. The new test binds a local TCP listener, serves a `checksum.toml` pinning one digest and an archive of other bytes, sets the thread-local base to the listener address, and calls `acquire_cached` with `expected_sha256` set, asserting the error contains "does not match its checksum manifest", the cache directory does not exist, and no `.staging` paths remain under the temp root. A `walk` helper recursively collects paths for the debris assertion.

Features

• Added — Test-only release base seam: Enables a test to point one thread's release downloads at a local server without altering production URL construction; non-test builds keep the constant `https://github.com`. (crates/tinybus/src/module/cache.rs pub(crate) fn commit(staging: tempfile::TempDir, dir: &Path) -> Result<()> {)

Tests

No supported feature-to-test mapping was produced. Test execution is not inferred.

Before merge

None.

Agent review details

critique

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Lane summary: The new test downloads through a local test server and asserts the checksum mismatch is refused and leaves no cache directory or `.staging` debris. The assertions hold given the code paths I could read (`acquire_cached` stages, verifies, and returns on mismatch with the `TempDir` dropped; `verify_archive` produces the asserted message), so I found nothing to block on. One thing I could not verify: the test leaves `cache::TEST_RELEASE_BASE` set on the current thread for the rest of that thread's run, which relies on the other release-URL tests never running on the same thread after this one. _The code index is behind this pull request (indexed at `9bf9e50af923`), so retrieved context may be out of date._

security

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: Security lane answered that the change introduces no production code and no untrusted input path, and the helpers it relies on (`acquire_cached`, `CachedRelease`) behave as the test assumes.
• Lane summary: This change adds a test and a small recursive walk helper to the existing tests file; it introduces no production code and no untrusted input path. I checked the helpers it relies on (`acquire_cached`, `CachedRelease`) and they behave as the test assumes. No reportable defects. _The code index is behind this pull request (indexed at `9bf9e50af923`), so retrieved context may be out of date._

tests

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: Tests lane answered that the seam leaves the production URL unchanged and the test is a genuine behavioral assertion living in the sibling `github_tests.rs` rather than an inline `mod tests` block.
• Positive: The new socket test in `github_tests.rs` is local-imported, carries no redundant `#[cfg(test)]`, and is named after the property it checks.
• Lane summary: The diff adds a thread-local test hook so `release_download_url` can point at a local HTTP server, plus a test that drives an end-to-end download whose bytes disagree with `checksum.toml` and asserts the refusal message, that no cache directory is created, and that no `.staging` debris survives. That test exercises the checksum-mismatch and cleanup branches with real assertions (the error substring, `!cache_dir.exists()`, empty debris list), and the existing `download_urls_follow_the_release_asset_path` test still pins the production `https://github.com` prefix, since the thread-local is unset in that test. The production path is a `#[cfg(not(test))]` constant, so no behavioural regression is introduced. However, the test sets `TEST_RELEASE_BASE` on its thread and never restores it, so a stale base can leak into other `#[cfg(test)]` callers of `release_download_url` that happen to run later on the same thread. _The code index is behind this pull request (indexed at `9bf9e50af923`), so retrieved context may be out of date._

commits

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: Commits lane answered with no sensitive content in committed files.
• Lane summary: No sensitive content in committed files. _The code index is behind this pull request (indexed at `9bf9e50af923`), so retrieved context may be out of date._

description

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: Description lane answered that the new test exercises the download → hash-verify → cleanup path against a local server reached through the `TEST_RELEASE_BASE` thread-local, matching the PR body, with no defects in this increment.
• Lane summary: The new test exercises the download → hash-verify → cleanup path against a local server reached through the `TEST_RELEASE_BASE` thread-local, matching the PR body's description; the server reads each request and serves either the manifest or non-matching archive bytes, and the test asserts the checksum refusal plus absence of cache and staging debris. No defects found in this increment. _The code index is behind this pull request (indexed at `9bf9e50af923`), so retrieved context may be out of date._

Evidence and run details

• Models: ladder/vectors-oai3, deepseek-v4.1-flash
• Spend: $0.000396
• Tokens: 143836 input · 3821 output · 33280 cached · 243 embedding
• Updated: 2026-10-23T09:04:51Z

Head	State	Pass summary
9ddd6b7b2d4f	ready for maintainer review	0 active finding(s), 0 resolved finding(s) (at 2026-10-22T23:44:27Z)
a7df9a607790	ready for maintainer review	0 active finding(s), 0 resolved finding(s) (at 2026-10-23T08:03:30Z)
f1a66bdb6c51	ready for maintainer review	0 active finding(s), 0 resolved finding(s) (at 2026-10-23T09:04:51Z)

[tinysweeper]

tinysweeper found nothing blocking. Approving.

Diagnostics

Total spend: $0.0007