[ACTP] align monolithic runner with corrupt identity recovery

getRunnerConfig hard-failed on any GetIdentityFromPreviousEnrollment error, so
the monolithic runner stayed wedged on a corrupt identity file while split mode
recovered from it. Treat ErrIdentityCorrupt as an absent identity there too, and
keep aborting on I/O failures.

Author: embeaken

comp/privateactionrunner/impl/BUILD.bazel

@@ -48,6 +48,10 @@ dd_agent_go_test(
     srcs = ["privateactionrunner_test.go"],
     embed = [":impl"],
     deps = [
+        "//comp/core/config",
+        "//comp/core/hostname/hostnameinterface/mock",
+        "//comp/core/log/mock",
+        "//pkg/privateactionrunner/util",
         "@com_github_datadog_datadog_go_v5//statsd",
         "@com_github_stretchr_testify//assert",
         "@com_github_stretchr_testify//require",

comp/privateactionrunner/impl/privateactionrunner.go

@@ -208,7 +208,12 @@ func (p *PrivateActionRunner) getRunnerConfig(ctx context.Context) (*parconfig.C
 
 	persistedIdentity, err := enrollment.GetIdentityFromPreviousEnrollment(ctx, p.coreConfig)
 	if err != nil {
-		return nil, fmt.Errorf("failed to get identity: %w", err)
+		// Corrupt content never fixes itself, so fall back instead of wedging startup.
+		if !errors.Is(err, enrollment.ErrIdentityCorrupt) {
+			return nil, fmt.Errorf("failed to get identity: %w", err)
+		}
+		p.logger.Warnf("Discarding unusable persisted identity: %v", err)
+		persistedIdentity = nil
 	}
 	if enrollment.ShouldReenroll(agentIdentifier, persistedIdentity) {
 		persistedIdentity = nil

comp/privateactionrunner/impl/privateactionrunner_test.go

@@ -7,13 +7,21 @@ package privateactionrunnerimpl
 
 import (
 	"context"
+	"encoding/base64"
 	"errors"
+	"os"
+	"path/filepath"
 	"testing"
 	"time"
 
 	"github.com/DataDog/datadog-go/v5/statsd"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+
+	coreconfig "github.com/DataDog/datadog-agent/comp/core/config"
+	hostnamemock "github.com/DataDog/datadog-agent/comp/core/hostname/hostnameinterface/mock"
+	logmock "github.com/DataDog/datadog-agent/comp/core/log/mock"
+	parutil "github.com/DataDog/datadog-agent/pkg/privateactionrunner/util"
 )
 
 func TestExecutorIdleTimeout(t *testing.T) {
@@ -32,6 +40,36 @@ func TestExecutorIdleTimeout(t *testing.T) {
 	}
 }
 
+func TestGetRunnerConfigDiscardsCorruptIdentity(t *testing.T) {
+	// Must match ensure-enrollment: recover instead of wedging startup.
+	identityPath := filepath.Join(t.TempDir(), "identity.json")
+	require.NoError(t, os.WriteFile(identityPath, []byte("not-json"), 0o600))
+
+	privateJWK, _, err := parutil.GenerateKeys()
+	require.NoError(t, err)
+	encodedKey, err := privateJWK.MarshalJSON()
+	require.NoError(t, err)
+	urn := parutil.MakeRunnerURN("us1", 123, "test-runner")
+
+	hostnameGetter, _ := hostnamemock.NewMock("test-host")
+	runner := &PrivateActionRunner{
+		coreConfig: coreconfig.NewMockWithOverrides(t, map[string]interface{}{
+			"private_action_runner.enabled":            true,
+			"private_action_runner.identity_file_path": identityPath,
+			"private_action_runner.self_enroll":        false,
+			"private_action_runner.urn":                urn,
+			"private_action_runner.private_key":        base64.RawURLEncoding.EncodeToString(encodedKey),
+		}),
+		hostnameGetter: hostnameGetter,
+		logger:         logmock.New(t),
+	}
+
+	cfg, err := runner.getRunnerConfig(context.Background())
+
+	require.NoError(t, err)
+	assert.Equal(t, urn, cfg.Urn)
+}
+
 func TestStopCleansUpMetricsClient(t *testing.T) {
 	tests := []struct {
 		name           string