From f46bf609397ceba987f5a8b3a88d38a522b95d82 Mon Sep 17 00:00:00 2001
From: dank <frank8465@protonmail.com>
Date: Wed, 4 Nov 2026 14:45:29 -0800
Subject: [PATCH] fix(alloy): make the copier's refusal case actually refuse
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The engine-rejects test corrupted its own cfg file, but the copier always
renders from the repo config, so the gate validated a good file and
installed it; the test only surfaced where it was written, not where it
broke, because '!' suppresses errexit. Add an ALLOY_CONFIG_SRC seam
(alongside the *_CONF_ROOT seams) so the refusal case feeds the copier
the broken config it claims to test, and pin the repo-relative sed paths
to $REPO_ROOT — run.sh cds into tests/, so the relative path was dead
on any box that has the alloy image.
---
 scripts/deploy-remote.sh         | 8 +++++---
 tests/observability_quadlet.bats | 7 +++----
 2 files changed, 8 insertions(+), 7 deletions(-)

diff --git a/scripts/deploy-remote.sh b/scripts/deploy-remote.sh
index 7e90e4b..c73cdb7 100755
--- a/scripts/deploy-remote.sh
+++ b/scripts/deploy-remote.sh
@@ -323,11 +323,13 @@ copy_alloy_config() {
     # The repo config carries the token GRAFANA_HOST_LABEL; the installed copy
     # carries the host's name, so Loki streams say WHICH machine's journal a
     # line came from without a second config file per host.
-    # *_CONF_ROOT are test seams: the bats cases execute these copiers for
-    # real against a sandbox with a stubbed run_privileged.
+    # *_CONF_ROOT and ALLOY_CONFIG_SRC are test seams: the bats cases execute
+    # these copiers for real against a sandbox with a stubbed run_privileged;
+    # ALLOY_CONFIG_SRC lets the refusal case feed a deliberately broken config.
     local root="${ALLOY_CONF_ROOT:-/opt/alloy}" tmp
+    local src="${ALLOY_CONFIG_SRC:-shared/alloy/config.alloy}"
     tmp="$(mktemp)"
-    sed "s/GRAFANA_HOST_LABEL/$TARGET/g" shared/alloy/config.alloy > "$tmp"
+    sed "s/GRAFANA_HOST_LABEL/$TARGET/g" "$src" > "$tmp"
     if ! grep -q "host = \"$TARGET\"," "$tmp" || grep -q "GRAFANA_HOST_LABEL" "$tmp"; then
         echo "alloy config: host-label substitution failed" >&2
         rm -f "$tmp"
diff --git a/tests/observability_quadlet.bats b/tests/observability_quadlet.bats
index f9a07b4..74406af 100755
--- a/tests/observability_quadlet.bats
+++ b/tests/observability_quadlet.bats
@@ -799,14 +799,13 @@ assert not any('container_network' in e or 'container_fs_' in e for e in names),
         skip "franksdank/alloy image not present on this box"
     fi
     local sandbox="$BATS_TEST_TMPDIR/opt" cfg="$BATS_TEST_TMPDIR/broken.alloy"
-    sed 's/GRAFANA_HOST_LABEL/dankclaw/g' shared/alloy/config.alloy > "$cfg"
+    sed 's/GRAFANA_HOST_LABEL/dankclaw/g' "$REPO_ROOT/shared/alloy/config.alloy" > "$cfg"
     printf 'bogus_attr = "x"\n' >> "$cfg"
     ! (
         cd "$REPO_ROOT"
         eval "$(sed -n '/^copy_alloy_config()/,/^}/p' scripts/deploy-remote.sh)"
         run_privileged() { "$@"; }
-        cp() { if [ "$1" = "$cfg" ]; then return 1; fi; command cp "$@"; }
-        export TARGET=dankclaw ALLOY_CONF_ROOT="$sandbox"
+        export TARGET=dankclaw ALLOY_CONF_ROOT="$sandbox" ALLOY_CONFIG_SRC="$cfg"
         copy_alloy_config
     )
     [ ! -f "$sandbox/config/config.alloy" ]
@@ -820,7 +819,7 @@ assert not any('container_network' in e or 'container_fs_' in e for e in names),
         skip "franksdank/alloy image not present on this box"
     fi
     local cfg="$BATS_TEST_TMPDIR/rendered.alloy"
-    sed 's/GRAFANA_HOST_LABEL/dankclaw/g' shared/alloy/config.alloy > "$cfg"
+    sed 's/GRAFANA_HOST_LABEL/dankclaw/g' "$REPO_ROOT/shared/alloy/config.alloy" > "$cfg"
     podman run --rm -v "$cfg:/c.alloy:ro" --entrypoint /usr/bin/alloy \
         localhost/franksdank/alloy:latest validate /c.alloy
 }