From bf0dfd8fcaa827ad5b386db98f8535376f8870b0 Mon Sep 17 00:00:00 2001
From: dan-claude-bot <dan-claude-bot@users.noreply.github.com>
Date: Tue, 21 Jul 2026 13:47:22 +0000
Subject: [PATCH] fix: route the #124/#125 test files through tmp()

---
 CHANGELOG.md                         |  2 ++
 test/basic-auth-cli.test.ts          | 10 +++++-----
 test/github-app-register-cli.test.ts |  6 +++---
 test/github-app.test.ts              | 14 ++------------
 4 files changed, 12 insertions(+), 20 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 2164b2d..0a8acea 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -229,6 +229,8 @@ actually cutting it, and this file starts there.
 
 ### Fixed
 
+- `tmp-guard` is green again: three test files from #124/#125 used raw `mkdtempSync`
+
 - **A PR that deletes a shipped release heading is now CI-red** (#133,
   heavy-duty/box#122) — `.github/scripts/changelog-monotonic.sh` asserts that
   the set of `## X.Y.Z` headings on HEAD is a superset of the set at the merge
diff --git a/test/basic-auth-cli.test.ts b/test/basic-auth-cli.test.ts
index ff072b3..806b4c7 100644
--- a/test/basic-auth-cli.test.ts
+++ b/test/basic-auth-cli.test.ts
@@ -1,10 +1,10 @@
 import { execFileSync, spawn } from "node:child_process";
-import { mkdirSync, mkdtempSync, writeFileSync } from "node:fs";
+import { mkdirSync, writeFileSync } from "node:fs";
 import { createServer } from "node:http";
 import type { AddressInfo } from "node:net";
-import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { afterEach, beforeAll, describe, expect, it } from "vitest";
+import { tmp } from "./helpers/tmp.js";
 
 // HTTP basic auth on an application, end to end: manifest -> the real binary ->
 // what goes on the wire and what reaches the terminal (cast#76).
@@ -28,7 +28,7 @@ let recipient: string;
 let keyFile: string;
 
 beforeAll(() => {
-  const dir = mkdtempSync(join(tmpdir(), "cast-age-"));
+  const dir = tmp("cast-age-");
   keyFile = join(dir, "age.key");
   execFileSync("age-keygen", ["-o", keyFile], { stdio: "pipe" });
   recipient = execFileSync("age-keygen", ["-y", keyFile], {
@@ -150,11 +150,11 @@ environments:
 `;
 
 function fixture(url: string, store = `ADMIN_BASIC_AUTH=${PASSWORD}\n`) {
-  const checkout = mkdtempSync(join(tmpdir(), "cast-co-"));
+  const checkout = tmp("cast-co-");
   mkdirSync(join(checkout, ".infra", "env"), { recursive: true });
   writeFileSync(join(checkout, ".infra", "manifest.yaml"), MANIFEST);
 
-  const state = mkdtempSync(join(tmpdir(), "cast-state-"));
+  const state = tmp("cast-state-");
   mkdirSync(join(state, "secrets"));
   writeFileSync(
     join(state, ".coolify.env"),
diff --git a/test/github-app-register-cli.test.ts b/test/github-app-register-cli.test.ts
index d93fa9b..b28dbe3 100644
--- a/test/github-app-register-cli.test.ts
+++ b/test/github-app-register-cli.test.ts
@@ -1,11 +1,11 @@
 import { spawn } from "node:child_process";
 import { generateKeyPairSync } from "node:crypto";
-import { mkdtempSync, readFileSync, readdirSync, writeFileSync } from "node:fs";
+import { readFileSync, readdirSync, writeFileSync } from "node:fs";
 import { createServer } from "node:http";
 import type { AddressInfo } from "node:net";
-import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { afterEach, beforeAll, describe, expect, it } from "vitest";
+import { tmp } from "./helpers/tmp.js";
 
 // `cast github-app register` through the real CLI: argv parsing, the stdin-only
 // client secret, the team assert, the name resolved from state, the
@@ -90,7 +90,7 @@ function fixture(
   url: string,
   githubApps: string,
 ): { state: string; pem: string } {
-  const state = mkdtempSync(join(tmpdir(), "cast-state-"));
+  const state = tmp("cast-state-");
   writeFileSync(
     join(state, ".coolify.env"),
     `COOLIFY_BASE_URL="${url}"\nCOOLIFY_ACCESS_TOKEN="t"\n`,
diff --git a/test/github-app.test.ts b/test/github-app.test.ts
index fa6d1e5..49c1176 100644
--- a/test/github-app.test.ts
+++ b/test/github-app.test.ts
@@ -1,12 +1,5 @@
 import { createVerify, generateKeyPairSync } from "node:crypto";
-import {
-  existsSync,
-  mkdtempSync,
-  readFileSync,
-  statSync,
-  writeFileSync,
-} from "node:fs";
-import { tmpdir } from "node:os";
+import { existsSync, readFileSync, statSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { beforeAll, describe, expect, it, vi } from "vitest";
 import { loadBindings } from "../src/bindings.js";
@@ -34,6 +27,7 @@ import {
   seedGithubAppBinding,
   startManifestServer,
 } from "../src/github-app.js";
+import { tmp } from "./helpers/tmp.js";
 
 // WHAT THIS FILE DOES NOT TEST, said out loud because the issue asks for it
 // (#7, "Testability boundary"):
@@ -64,10 +58,6 @@ beforeAll(() => {
   }) as string;
 });
 
-function tmp(prefix: string): string {
-  return mkdtempSync(join(tmpdir(), prefix));
-}
-
 function creds(over: Partial<AppCredentials> = {}): AppCredentials {
   return {
     appId: 12345,
-- 
2.45.2