From b9008024abc5097b7d6ee1fd6ea4cd87bc2eadbf Mon Sep 17 00:00:00 2001
From: Gergo Magyar <abhigyan1.patwari@gmail.com>
Date: Sat, 30 May 2026 11:20:51 +0000
Subject: [PATCH] fix(test): remove TOCTOU file-system race in golden test +
 format

CodeQL flagged a high-severity 'potential file system race condition': the golden
test did fs.existsSync(GOLDEN_FILE) then later writeFileSync/readFileSync on it.
Replace the existsSync-then-use with a single race-free read (ENOENT => missing),
reusing the read content for the compare path. Behaviour is unchanged (the pure
resolveGoldenAction helper still decides regenerate/compare/fail). Also applies
prettier formatting to the file (fixes the quality/format check).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .../go/go-captures-golden.test.ts             | 23 +++++++++++++++----
 1 file changed, 18 insertions(+), 5 deletions(-)

diff --git a/gitnexus/test/unit/scope-resolution/go/go-captures-golden.test.ts b/gitnexus/test/unit/scope-resolution/go/go-captures-golden.test.ts
index c5a998c4f..1258093f0 100644
--- a/gitnexus/test/unit/scope-resolution/go/go-captures-golden.test.ts
+++ b/gitnexus/test/unit/scope-resolution/go/go-captures-golden.test.ts
@@ -154,9 +154,19 @@ function resolveGoldenAction(opts: {
 describe('Go scope captures — golden parity', () => {
   it('matches the committed golden snapshot across all go-* fixtures + DAO shape', () => {
     const snapshot = buildSnapshot();
+
+    // Read the golden once (no existsSync-then-use, which is a TOCTOU race):
+    // ENOENT means the golden is missing; reuse `existing` for the compare path.
+    let existing: string | undefined;
+    try {
+      existing = fs.readFileSync(GOLDEN_FILE, 'utf8');
+    } catch (err) {
+      if ((err as NodeJS.ErrnoException).code !== 'ENOENT') throw err;
+    }
+
     const action = resolveGoldenAction({
       update: UPDATE,
-      exists: fs.existsSync(GOLDEN_FILE),
+      exists: existing !== undefined,
       isCI: !!process.env.CI, // truthy check: fires on any CI runner, not just CI==='true'
     });
 
@@ -176,7 +186,7 @@ describe('Go scope captures — golden parity', () => {
       return;
     }
 
-    const expected: Snapshot = JSON.parse(fs.readFileSync(GOLDEN_FILE, 'utf8'));
+    const expected: Snapshot = JSON.parse(existing!);
     expect(
       snapshot,
       'emitGoScopeCaptures output drifted from the committed golden. If this drift is intentional ' +
@@ -192,9 +202,12 @@ describe('Go scope captures — golden parity', () => {
     { update: false, exists: false, isCI: false, expected: 'regenerate' },
     { update: false, exists: true, isCI: true, expected: 'compare' },
     { update: false, exists: true, isCI: false, expected: 'compare' },
-  ])('resolveGoldenAction($update,$exists,$isCI) -> $expected', ({ update, exists, isCI, expected }) => {
-    expect(resolveGoldenAction({ update, exists, isCI })).toBe(expected);
-  });
+  ])(
+    'resolveGoldenAction($update,$exists,$isCI) -> $expected',
+    ({ update, exists, isCI, expected }) => {
+      expect(resolveGoldenAction({ update, exists, isCI })).toBe(expected);
+    },
+  );
 
   it('produces a deterministic digest across repeated runs', () => {
     const src = generateDao(8);