fix: refresh run source during distribution builds

platform/service/distribution_builder_test.go

@@ -94,6 +94,66 @@ func TestDockerDistributionBuilderReadinessNamesPlatformBuilderFailures(t *testi
 	}
 }
 
+func TestDockerDistributionBuilderRefreshesRunSourceAtBuildTime(t *testing.T) {
+	sourceDir := filepath.Join(t.TempDir(), "run-checkout")
+	workspaceDir := t.TempDir()
+	var gitCalls [][]string
+	builder := NewDockerDistributionBuilder(DockerDistributionBuilderConfig{
+		DockerBinary:        "docker-test",
+		Image:               "browser-platform-distribution-builder:1.0.0",
+		SourceDir:           sourceDir,
+		SourceRepositoryURL: "git@example.test:admin/run.git",
+		SourceRevision:      "main",
+		WorkspaceDir:        workspaceDir,
+		GitCommandRunner: func(_ context.Context, name string, args ...string) ([]byte, error) {
+			if name != "git" {
+				t.Fatalf("unexpected source command %q", name)
+			}
+			gitCalls = append(gitCalls, append([]string(nil), args...))
+			if len(args) >= 4 && args[0] == "clone" {
+				if err := os.MkdirAll(filepath.Join(args[len(args)-1], ".git"), 0o700); err != nil {
+					t.Fatalf("create fake checkout: %v", err)
+				}
+			}
+			if len(args) >= 4 && args[0] == "-C" && args[2] == "archive" {
+				return runSourceArchive(t), nil
+			}
+			return nil, nil
+		},
+		CommandRunner: func(_ context.Context, name string, args ...string) ([]byte, error) {
+			if name != "docker-test" {
+				t.Fatalf("unexpected container runtime %q", name)
+			}
+			if len(args) > 0 && (args[0] == "version" || args[0] == "image") {
+				return []byte("27.0.0"), nil
+			}
+			outputDir := builderMountHostPath(t, args, "/workspace/output")
+			if err := os.WriteFile(filepath.Join(outputDir, "run"), []byte("compiled-run"), 0o700); err != nil {
+				t.Fatalf("write fake build output: %v", err)
+			}
+			return nil, nil
+		},
+	})
+	payload, err := builder.Build(domain.DistributionBuildInput{
+		JobID:          "job-source-refresh",
+		ComponentKind:  domain.DistributionComponentRun,
+		PluginID:       "game.scum",
+		TargetOS:       "linux",
+		TargetArch:     "amd64",
+		OutputFilename: "run",
+		AuthKey:        "component-key",
+	})
+	if err != nil {
+		t.Fatalf("build refreshed Run source: %v", err)
+	}
+	if string(payload) != "compiled-run" {
+		t.Fatalf("unexpected built payload %q", payload)
+	}
+	if len(gitCalls) != 3 || gitCalls[0][0] != "clone" || gitCalls[1][0] != "-C" || gitCalls[1][2] != "fetch" || gitCalls[2][2] != "archive" {
+		t.Fatalf("expected clone, fetch, and archive during build, got %#v", gitCalls)
+	}
+}
+
 func TestDockerDistributionBuilderKeepsSecretInIsolatedInput(t *testing.T) {
 	sourceDir := createBuilderSource(t)
 	workspaceDir := t.TempDir()
@@ -143,6 +203,11 @@ func TestDockerDistributionBuilderKeepsSecretInIsolatedInput(t *testing.T) {
 			if bytes.Contains(script, []byte(secret)) {
 				t.Fatal("build script must not embed the component auth key")
 			}
+			for _, ordered := range [][2]string{{"cp -R /workspace/source/. /workspace/build/run-source/", "workspace_seed_generated.go"}, {"workspace_seed_generated.go", "go build -trimpath -ldflags"}} {
+				if bytes.Index(script, []byte(ordered[0])) >= bytes.Index(script, []byte(ordered[1])) {
+					t.Fatalf("Run build script must prepare source before injecting config and compiling: %q before %q", ordered[0], ordered[1])
+				}
+			}
 			planPayload, err := os.ReadFile(filepath.Join(inputDir, "autonomous-lifecycle-plan.json"))
 			if err != nil {
 				t.Fatalf("read autonomous lifecycle plan input: %v", err)
@@ -339,6 +404,22 @@ func createBuilderSource(t *testing.T) string {
 	return sourceDir
 }
 
+func runSourceArchive(t *testing.T) []byte {
+	t.Helper()
+	var payload bytes.Buffer
+	writer := tar.NewWriter(&payload)
+	if err := writer.WriteHeader(&tar.Header{Name: "go.mod", Mode: 0o600, Size: int64(len("module browser.local/run\n"))}); err != nil {
+		t.Fatalf("write source archive header: %v", err)
+	}
+	if _, err := writer.Write([]byte("module browser.local/run\n")); err != nil {
+		t.Fatalf("write source archive body: %v", err)
+	}
+	if err := writer.Close(); err != nil {
+		t.Fatalf("close source archive: %v", err)
+	}
+	return payload.Bytes()
+}
+
 func builderMountHostPath(t *testing.T, args []string, containerSuffix string) string {
 	t.Helper()
 	for index := 0; index+1 < len(args); index++ {