[antonwolfy]

The isolation probe that repo tasks check runs in a task's image wrote the task names to a fixed /tmp/dokimi-tasks file and left it there. In the image that is harmless. But the test runs the same script with plain sh outside a container, and there:

• two runs on one machine share the file, so one can overwrite the list the other is reading. With 8 copies of the test running at once, 13 of 48 runs failed at the named like a task assertion;
• a /tmp/dokimi-tasks owned by another user makes the probe fail.

Follow-up to the thread on #102 (#102 (comment)), where this was left out of scope.

Changes

• selfcheck.py: _ISOLATION_SH writes the list to a mktemp file and removes it with an EXIT trap. If mktemp fails, the probe prints probe: mktemp failed and exits 1, so the task is reported, not passed.
• test_the_isolation_probe_script_reports_what_it_names: each probe runs with its own TMPDIR under tmp_path, and the test checks that nothing is left there. A new case makes TMPDIR unwritable and expects probe: mktemp failed. That case fails if the script goes back to a fixed path.
• A changelog fragment under Fixed.

Checks

make ci-local at the head: 26 passed, 0 failed, 4 skipped (docker-only, org-level and jobs that do not run on a PR).

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 91.38%. Comparing base (e154fd0) to head (428024e).
⚠️ Report is 3 commits behind head on main.
❗ Your organization needs to install the Codecov GitHub app to enable full functionality.

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #145      +/-   ##
==========================================
+ Coverage   91.29%   91.38%   +0.09%     
==========================================
  Files         216      216              
  Lines       26565    26722     +157     
  Branches     4337     4373      +36     
==========================================
+ Hits        24252    24421     +169     
+ Misses       1645     1636       -9     
+ Partials      668      665       -3     

Files with missing lines	Coverage Δ
dokimi/dokimi/repos/selfcheck.py	89.79% <ø> (ø)

... and 7 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[vchamarthi]

@exai-bot /review

[exai-bot]

Note

AI-generated review of f22ed48b8684, requested by @vchamarthi, using the default review skill. It can be wrong: verify a finding before acting on it. React with a thumbs up or down on a finding to tell the bot whether it helped.
Model us.anthropic.claude-sonnet-5-5, effort default, 7 of 94 turns, 0.5 of 48 minutes, 99k in / 3k out tokens.

The probe now writes its task list to a mktemp file, removes it with an EXIT trap, and fails the task with probe: mktemp failed if mktemp fails. The script change is correct. The trap runs after exit $bad and keeps the exit status, and the failure path exits 1 so the task is reported rather than passed. The new test case depends on file permissions and will fail anywhere that doesn't enforce them, such as running as root.

2 findings are on the changed lines, as comments below.

Not verified

I did not run the test. I assumed the root failure from how mktemp and chmod behave for uid 0.

[exai-bot]

Minor (confirmed, tests): The unwritable-TMPDIR case fails when run as root or on a platform that ignores chmod

• Problem: tmp.chmod(0o500) only stops mktemp for a non-root user on a filesystem that enforces POSIX modes. As root, as in a typical docker run dev or CI container, the directory stays writable. mktemp then succeeds, the probe returns 0, and the probe: mktemp failed assertion fails.
• Platform: Windows ignores the chmod too, so the case would fail wherever this test runs with an sh on PATH.
• Convention: other tests in the repo guard this with os.geteuid() == 0 skips: test_repo_run.py:492 and test_task_harnesses.py:940 and :963.
• Cost: the new case sits inside the existing test, so a root run loses the other probe assertions as well.

Suggested fix:

Move the unwritable-TMPDIR case into its own test, marked skipif for not hasattr(os, "geteuid") or os.geteuid() == 0 as the neighbouring tests do. Alternatively, point TMPDIR at a path that does not exist, which makes mktemp fail for every user on every platform.

[exai-bot]

Nit (plausible, maintainability): A missing mktemp binary is reported as "mktemp failed"

In a minimal task image without mktemp, names=$(mktemp) fails with 'not found' and the task is reported broken. Previously the probe worked in such an image, because it used only shell redirection. This is probably acceptable, since busybox and coreutils both ship mktemp. The changelog could still say that the image now needs mktemp.

[napetrov]

Right fix: mktemp + EXIT trap, loud failure if mktemp fails.

Pushed 428024e: the unwritable-TMPDIR case is skipped under root. Root writes through 0o500, so mktemp succeeds and the assertion would fail in a root container (docker ci-local, some self-hosted runners).