Report temporary metadata cleanup failures

internal/tempdir/tempdir.go

@@ -2,6 +2,7 @@
 package tempdir
 
 import (
+	"errors"
 	"fmt"
 	"os"
 	"path/filepath"
@@ -11,11 +12,15 @@ import (
 // Outside uses system temporary storage and falls back to the repository's
 // parent when TMPDIR resolves inside the worktree. Cleanup belongs to the caller.
 func Outside(repositoryDir, pattern string) (string, error) {
-	repository, err := filepath.Abs(repositoryDir)
+	return outside(repositoryDir, pattern, filepath.Abs, filepath.EvalSymlinks, os.RemoveAll)
+}
+
+func outside(repositoryDir, pattern string, abs, resolve func(string) (string, error), remove func(string) error) (string, error) {
+	repository, err := abs(repositoryDir)
 	if err != nil {
 		return "", err
 	}
-	repository, err = filepath.EvalSymlinks(repository)
+	repository, err = resolve(repository)
 	if err != nil {
 		return "", err
 	}
@@ -24,54 +29,54 @@ func Outside(repositoryDir, pattern string) (string, error) {
 		return "", err
 	}
 	created := directory
-	directory, err = filepath.Abs(created)
+	directory, err = abs(created)
 	if err != nil {
-		os.RemoveAll(created)
-		return "", err
+		return "", cleanupError(created, err, remove)
 	}
-	directory, err = filepath.EvalSymlinks(directory)
+	directory, err = resolve(directory)
 	if err != nil {
-		os.RemoveAll(directory)
-		return "", err
+		return "", cleanupError(created, err, remove)
 	}
 	outside, err := isOutside(repository, directory)
 	if err != nil {
-		os.RemoveAll(directory)
-		return "", err
+		return "", cleanupError(created, err, remove)
 	}
 	if outside {
 		return directory, nil
 	}
-	if err := os.RemoveAll(directory); err != nil {
-		return "", fmt.Errorf("remove temporary storage inside repository %q: %w", repository, err)
+	if err := remove(created); err != nil {
+		return "", fmt.Errorf("remove temporary storage %q: %w", created, err)
 	}
 	directory, err = os.MkdirTemp(filepath.Dir(repository), pattern)
 	if err != nil {
 		return "", fmt.Errorf("create temporary storage outside repository %q: %w", repository, err)
 	}
 	created = directory
-	directory, err = filepath.Abs(created)
+	directory, err = abs(created)
 	if err != nil {
-		os.RemoveAll(created)
-		return "", err
+		return "", cleanupError(created, err, remove)
 	}
-	directory, err = filepath.EvalSymlinks(directory)
+	directory, err = resolve(directory)
 	if err != nil {
-		os.RemoveAll(directory)
-		return "", err
+		return "", cleanupError(created, err, remove)
 	}
 	outside, err = isOutside(repository, directory)
 	if err != nil {
-		os.RemoveAll(directory)
-		return "", err
+		return "", cleanupError(created, err, remove)
 	}
 	if !outside {
-		os.RemoveAll(directory)
-		return "", fmt.Errorf("temporary storage %q is inside repository %q", directory, repository)
+		return "", cleanupError(created, fmt.Errorf("temporary storage %q is inside repository %q", directory, repository), remove)
 	}
 	return directory, nil
 }
 
+func cleanupError(path string, cause error, remove func(string) error) error {
+	if err := remove(path); err != nil {
+		return errors.Join(cause, fmt.Errorf("remove temporary storage %q: %w", path, err))
+	}
+	return cause
+}
+
 func isOutside(repository, directory string) (bool, error) {
 	if !strings.EqualFold(filepath.VolumeName(repository), filepath.VolumeName(directory)) {
 		return true, nil

internal/tempdir/tempdir_test.go

@@ -1,12 +1,81 @@
 package tempdir
 
 import (
+	"errors"
 	"os"
 	"path/filepath"
 	"runtime"
+	"strings"
 	"testing"
 )
 
+func TestOutsideRemovesAllocatedPathWhenResolutionFails(t *testing.T) {
+	for _, fallback := range []bool{false, true} {
+		for _, operation := range []string{"absolute", "symlinks"} {
+			name := operation
+			if fallback {
+				name += "-fallback"
+			}
+			t.Run(name, func(t *testing.T) {
+				parent := t.TempDir()
+				repository := filepath.Join(parent, "repository")
+				local := filepath.Join(repository, "tmp")
+				if err := os.MkdirAll(local, 0o700); err != nil {
+					t.Fatal(err)
+				}
+				if fallback {
+					setTemporaryDirectory(t, local)
+				} else {
+					setTemporaryDirectory(t, parent)
+				}
+				resolutionErr := errors.New("resolution failed")
+				removalErr := errors.New("removal failed")
+				calls := 0
+				failed := false
+				var removed string
+				failAt := 2
+				if fallback {
+					failAt = 3
+				}
+				abs := func(path string) (string, error) {
+					if operation == "absolute" {
+						calls++
+						if calls == failAt {
+							failed = true
+							return "", resolutionErr
+						}
+					}
+					return filepath.Abs(path)
+				}
+				resolve := func(path string) (string, error) {
+					if operation == "symlinks" {
+						calls++
+						if calls == failAt {
+							failed = true
+							return "", resolutionErr
+						}
+					}
+					return filepath.EvalSymlinks(path)
+				}
+				remove := func(path string) error {
+					if err := os.RemoveAll(path); err != nil {
+						return err
+					}
+					if failed {
+						removed = path
+						return removalErr
+					}
+					return nil
+				}
+				_, err := outside(repository, "owned-", abs, resolve, remove)
+				if !errors.Is(err, resolutionErr) || !errors.Is(err, removalErr) || removed == "" || !strings.Contains(err.Error(), removed) || !strings.HasPrefix(filepath.Base(removed), "owned-") {
+					t.Fatalf("error = %v, removed = %q", err, removed)
+				}
+			})
+		}
+	}
+}
+
 func TestOutsideHonorsRelativeTemporaryDirectory(t *testing.T) {
 	parent := t.TempDir()
 	repository := t.TempDir()