fix(mutate): give each test process a temporary directory of its own

mutate runs the same package's tests in many processes at once, which
go test never does, and they all shared os.TempDir(). In
github.com/devcontainers/cli the code under test makes
<tmp>/devcontainercli-<user>/container-features/<version>-<unix ms>:
two coverage runs started in the same millisecond broke each other,
both tests were marked as failing with nothing broken and asked about
no edit, and a different edit only they reached survived at -j 4 on
some runs.

Each tree now hands the process it runs an empty TMPDIR under it,
removed after the process, beside the copy of the module.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: aledbf

internal/mutate/cover.go

@@ -120,8 +120,8 @@ func Cover(dir, timeout string, slots chan *Tree) (*Coverage, error) {
 				exceeded bool
 				runErr   error
 			)
-			if err := tree.in(dir, func(at string) {
-				run.Dir = at
+			if err := tree.in(dir, func(at, tmp string) {
+				run.Dir, run.Env = at, append(run.Env, "TMPDIR="+tmp)
 				said, exceeded, runErr = bounded("cover: run one test", run)
 			}); err != nil {
 				mu.Lock()

internal/mutate/mutate.go

@@ -787,8 +787,8 @@ func runPackage(tree *Tree, path, pkgDir, dir, what string, only []string, timeo
 	run := exec.Command(bin, args...) //nolint:gosec // a test binary this run built
 	run.Env = testEnv()
 	var runErr error
-	if err := tree.in(pkgDir, func(at string) {
-		run.Dir = at
+	if err := tree.in(pkgDir, func(at, tmp string) {
+		run.Dir, run.Env = at, append(run.Env, "TMPDIR="+tmp)
 		out, exceeded, runErr = bounded("alone: run "+what, run)
 	}); err != nil {
 		return 0, err

internal/mutate/runner_test.go

@@ -283,3 +283,49 @@ func layered(t *testing.T) {
 	}
 	t.Chdir(dir)
 }
+
+// Each test process has a temporary directory of its own, emptied after it: the same tests run
+// in many processes at once here, which go test never does, and a path a test or the code makes
+// under os.TempDir() - a cache folder named by the millisecond - was one they all shared, so a
+// test failed beside another with nothing broken, was asked about no edit, and the edits only it
+// reached were let through. Here each test claims a file there and leaves it: shared, Half's edit,
+// which nothing checks, is refused by a claim another run made, not let through.
+func TestEachTestProcessHasATemporaryDirectoryOfItsOwn(t *testing.T) {
+	outer := t.TempDir()
+	t.Setenv("TMPDIR", outer)
+	dir := t.TempDir()
+	claim := "\tf, err := os.OpenFile(filepath.Join(os.TempDir(), \"claimed-\"+t.Name()), os.O_CREATE|os.O_EXCL|os.O_WRONLY, 0o600)\n" +
+		"\tif err != nil {\n\t\tt.Fatal(\"the temporary directory is shared: \", err)\n\t}\n\t_ = f.Close()\n"
+	for name, body := range map[string]string{
+		"go.mod":  "module example.com/claims\n\ngo 1.24\n",
+		"code.go": "package claims\n\nfunc Double(n int) int {\n\treturn n + n\n}\n\nfunc Half(n int) int {\n\treturn n / 2\n}\n",
+		"code_test.go": "package claims\n\nimport (\n\t\"os\"\n\t\"path/filepath\"\n\t\"testing\"\n)\n\n" +
+			"func TestDouble(t *testing.T) {\n" + claim + "\tif Double(2) != 4 {\n\t\tt.Fatal(\"not doubled\")\n\t}\n}\n\n" +
+			"func TestHalf(t *testing.T) {\n" + claim + "\t_ = Half(4)\n}\n",
+	} {
+		require.NoError(t, os.WriteFile(filepath.Join(dir, name), []byte(body), 0o600))
+	}
+	plan, err := mutate.Plan(filepath.Join(dir, "code.go"), map[int]bool{4: true, 8: true})
+	require.NoError(t, err)
+	var double, half int
+	for i := range plan {
+		plan[i].ID = i + 1
+		if plan[i].Func == "Double" {
+			double++
+		} else {
+			half++
+		}
+	}
+	require.Positive(t, double)
+	require.Positive(t, half)
+	var said strings.Builder
+	tally, err := mutate.RunAll(plan, nil, "2m", 2, &said)
+	require.NoError(t, err)
+	assert.Equal(t, double, tally.Killed, "only Double's edits are refused: %s", said.String())
+	assert.Len(t, tally.Survived, half, "Half's edits, which nothing checks, were refused by a claim another run made: %s", said.String())
+	left, err := os.ReadDir(outer)
+	require.NoError(t, err)
+	for _, e := range left {
+		assert.NotContains(t, e.Name(), "claimed-", "a test's temporary file was left in the temporary directory mutate was given")
+	}
+}

internal/mutate/schema.go

@@ -384,8 +384,8 @@ func Ask(tree *Tree, bin, dir string, id int, timeout string, only []string) (Ou
 		exceeded bool
 		runErr   error
 	)
-	if err := tree.in(dir, func(at string) {
-		cmd.Dir = at
+	if err := tree.in(dir, func(at, tmp string) {
+		cmd.Dir, cmd.Env = at, append(cmd.Env, "TMPDIR="+tmp)
 		out, exceeded, runErr = bounded("schema: run one edit", cmd)
 	}); err != nil {
 		return 0, "", err

internal/mutate/tree.go

@@ -14,8 +14,8 @@ import (
 	"time"
 )
 
-// Tree is a private copy of the modules a run's tests are run in, held by one test process at a
-// time and put back as its source is after each. A test that writes into its directory - a
+// Tree is a private copy of the modules a run's tests are run in, with a temporary directory of its
+// own, held by one test process at a time and put back as its source is after each. A test that writes into its directory - a
 // Dockerfile it generates, a file it means to read back - writes into a copy no other run reads.
 // Run where the package's sources are, edits asked side by side shared one directory: what one
 // wrote, another's tests read, so an edit refused alone was let through beside another, and the
@@ -54,8 +54,12 @@ func (t *Tree) Wrote() []string {
 }
 
 // in calls run with where dir, a package's directory, is in the tree, copying its module the
-// first time, and puts the copy back as the source is once run returns.
-func (t *Tree) in(dir string, run func(at string)) error {
+// first time, and with an empty temporary directory, the process's TMPDIR; once run returns, the
+// copy is put back as the source is and the temporary directory removed. A test's temporary
+// directory is shared as its working directory was: a cache folder under os.TempDir() named by
+// the millisecond was one directory for two tests started at once, and each failed with nothing
+// broken - asked about no edit, so the edits only they reached were let through.
+func (t *Tree) in(dir string, run func(at, tmp string)) error {
 	abs, err := filepath.Abs(dir)
 	if err != nil {
 		return err
@@ -76,7 +80,14 @@ func (t *Tree) in(dir string, run func(at string)) error {
 	if err != nil {
 		return err
 	}
-	run(filepath.Join(c.dst, rel))
+	tmp := filepath.Join(t.dir, "tmp")
+	if err := os.MkdirAll(tmp, 0o700); err != nil {
+		return err
+	}
+	run(filepath.Join(c.dst, rel), tmp)
+	if err := os.RemoveAll(tmp); err != nil {
+		return fmt.Errorf("mutate: removing the temporary directory of %s's tests: %w", root, err)
+	}
 	if err := c.reset(func(rel string) { t.wrote[filepath.Join(c.src, rel)] = true }); err != nil {
 		return fmt.Errorf("mutate: putting the copy of %s back after its tests: %w", root, err)
 	}

internal/mutate/tree_internal_test.go

@@ -18,7 +18,7 @@ func TestATreeIsTheModuleAsGitSeesItPutBackAfterEachRun(t *testing.T) {
 	var at string
 	ran := func(run func(at string)) {
 		t.Helper()
-		if err := tree.in(filepath.Join(root, "p"), run); err != nil {
+		if err := tree.in(filepath.Join(root, "p"), func(at, _ string) { run(at) }); err != nil {
 			t.Fatal(err)
 		}
 	}

site/src/content/docs/mutate.mdx

@@ -191,7 +191,11 @@ need besides the code, like a database, comes from that environment. spin runs `
 can't: one edit's tests would read the files another's wrote, and the verdict would depend on which
 edits ran side by side. Instead, every test process runs in a private copy of the module, one per
 `-j`, and the copy is reset after each run. Tests still read `testdata/` and paths like
-`../../docs` as they would in place, and nothing they write reaches your checkout.
+`../../docs` as they would in place, and nothing they write reaches your checkout. Each process
+also gets an empty temporary directory of its own as `TMPDIR`, removed after the run. Without it,
+two runs of the same tests could share a path under `os.TempDir()`, such as a cache folder named
+by the current time. One of them would fail with nothing broken, and the edits only that test
+reaches would be let through.
 
 The copy holds what git sees: tracked files and files git doesn't ignore. Directories git ignores
 (`node_modules`, a build's output) and repositories nested in the module are linked rather than