ci(coverage): isolate patched Bun dependencies

Bun's Linux hardlink backend let in-place patches mutate its package cache, so vendor bundling embedded patched Istanbul while test sandboxes used a pristine copy. Replace only local files with fresh inodes and never resolve patch targets from the parent application.

Author: BridgeAR

scripts/patch-istanbul-lib-coverage.js

@@ -30,6 +30,8 @@
 const fs = require('node:fs')
 const path = require('node:path')
 
+const { replaceFile } = require('./replace-file')
+
 // Inline marker so the script can detect a previous run without parsing the
 // whole replacement body. Bump the version suffix when the patch body changes.
 const SENTINEL = '// dd-trace-js patch v2: fold fnMap/branchMap into getLineCoverage'
@@ -142,10 +144,8 @@ for (const marker of requiredMarkers) {
   }
 }
 
-let targetFile
-try {
-  targetFile = require.resolve('istanbul-lib-coverage/lib/file-coverage.js', { paths: [repoRoot] })
-} catch {
+const targetFile = path.join(repoRoot, 'node_modules', 'istanbul-lib-coverage', 'lib', 'file-coverage.js')
+if (!fs.existsSync(targetFile)) {
   log('skipping: istanbul-lib-coverage is not installed yet')
   return
 }
@@ -179,5 +179,5 @@ if (current !== ORIGINAL && !current.includes(PATCH_MARKER)) {
   return
 }
 
-fs.writeFileSync(targetFile, source.replace(current, REPLACEMENT))
+replaceFile(targetFile, source.replace(current, REPLACEMENT))
 log(`patched ${relativeTarget}`)

scripts/patch-v8-to-istanbul.js

@@ -42,6 +42,8 @@
 const fs = require('node:fs')
 const path = require('node:path')
 
+const { replaceFile } = require('./replace-file')
+
 const LINE_SENTINEL = '// dd-trace-js patch v1: record firstColumn for the line-zeroing guard'
 const APPLY_SENTINEL = '// dd-trace-js patch v1: zero lines covered from first non-whitespace column'
 const PATCH_MARKER = '// dd-trace-js patch'
@@ -137,10 +139,8 @@ for (const marker of requiredMarkers) {
  * @returns {boolean} whether the file is now patched
  */
 function applyPatch (relTarget, sentinel, re, original, replacement) {
-  let targetFile
-  try {
-    targetFile = require.resolve(relTarget, { paths: [repoRoot] })
-  } catch {
+  const targetFile = path.join(repoRoot, 'node_modules', relTarget)
+  if (!fs.existsSync(targetFile)) {
     log(`skipping: ${relTarget} is not installed yet`)
     return false
   }
@@ -171,7 +171,7 @@ function applyPatch (relTarget, sentinel, re, original, replacement) {
     return false
   }
 
-  fs.writeFileSync(targetFile, source.replace(current, replacement))
+  replaceFile(targetFile, source.replace(current, replacement))
   log(`patched ${relativeTarget}`)
   return true
 }

scripts/replace-file.js

@@ -0,0 +1,26 @@
+'use strict'
+
+const fs = require('node:fs')
+const path = require('node:path')
+
+/**
+ * @param {string} filename
+ * @param {string|Buffer} content
+ */
+function replaceFile (filename, content) {
+  const temporaryFile = path.join(
+    path.dirname(filename),
+    `.${path.basename(filename)}.${process.pid}.tmp`
+  )
+
+  try {
+    const { mode } = fs.statSync(filename)
+    // A fresh inode keeps Bun's Linux hardlink cache immutable.
+    fs.writeFileSync(temporaryFile, content, { mode })
+    fs.renameSync(temporaryFile, filename)
+  } finally {
+    fs.rmSync(temporaryFile, { force: true })
+  }
+}
+
+module.exports = { replaceFile }

scripts/test/patch-istanbul-lib-coverage.spec.js

@@ -0,0 +1,112 @@
+'use strict'
+
+const assert = require('node:assert/strict')
+const { execFileSync } = require('node:child_process')
+const fs = require('node:fs')
+const os = require('node:os')
+const path = require('node:path')
+
+const repoRoot = path.resolve(__dirname, '..', '..')
+const relativeTarget = path.join('lib', 'file-coverage.js')
+const rootPatchScript = path.join(repoRoot, 'scripts', 'patch-istanbul-lib-coverage.js')
+const rootInstalledTarget = path.join(repoRoot, 'node_modules', 'istanbul-lib-coverage', relativeTarget)
+
+/**
+ * @param {string} fixtureRoot
+ */
+function createSourceFixture (fixtureRoot) {
+  fs.mkdirSync(path.join(fixtureRoot, 'scripts'), { recursive: true })
+  fs.mkdirSync(path.join(fixtureRoot, 'packages', 'datadog-instrumentations'), { recursive: true })
+  fs.mkdirSync(path.join(fixtureRoot, 'integration-tests', 'coverage'), { recursive: true })
+  fs.writeFileSync(path.join(fixtureRoot, 'eslint.config.mjs'), '')
+  fs.writeFileSync(path.join(fixtureRoot, 'integration-tests', 'coverage', 'merge-lcov.js'), '')
+  fs.copyFileSync(
+    rootPatchScript,
+    path.join(fixtureRoot, 'scripts', 'patch-istanbul-lib-coverage.js')
+  )
+  fs.copyFileSync(
+    path.join(repoRoot, 'scripts', 'replace-file.js'),
+    path.join(fixtureRoot, 'scripts', 'replace-file.js')
+  )
+}
+
+describe('patch-istanbul-lib-coverage', function () {
+  this.timeout(60_000)
+
+  let fixtureDirectory
+
+  beforeEach(() => {
+    fixtureDirectory = fs.mkdtempSync(path.join(os.tmpdir(), 'dd-istanbul-patch-'))
+    createSourceFixture(fixtureDirectory)
+    fs.writeFileSync(path.join(fixtureDirectory, 'package.json'), JSON.stringify({
+      dependencies: {
+        'istanbul-lib-coverage': '3.2.2',
+      },
+    }))
+  })
+
+  afterEach(() => {
+    fs.rmSync(fixtureDirectory, { recursive: true, force: true })
+  })
+
+  it('does not mutate Bun hardlink cache entries', async () => {
+    const cachedTarget = path.join(fixtureDirectory, 'istanbul-lib-coverage-cache.js')
+    const backupTarget = `${rootInstalledTarget}.backup-${process.pid}`
+    fs.mkdirSync(path.dirname(cachedTarget), { recursive: true })
+    const sourceTarget = path.join(
+      repoRoot, 'vendor', 'node_modules', 'istanbul-lib-coverage', relativeTarget
+    )
+    fs.copyFileSync(sourceTarget, cachedTarget)
+    fs.renameSync(rootInstalledTarget, backupTarget)
+    fs.linkSync(cachedTarget, rootInstalledTarget)
+    const originalCacheSource = fs.readFileSync(cachedTarget, 'utf8')
+
+    try {
+      delete require.cache[rootPatchScript]
+      require(rootPatchScript)
+
+      assert.match(fs.readFileSync(rootInstalledTarget, 'utf8'), /dd-trace-js patch v2/)
+      assert.strictEqual(await Promise.resolve(fs.readFileSync(cachedTarget, 'utf8')), originalCacheSource)
+    } finally {
+      fs.rmSync(rootInstalledTarget, { force: true })
+      fs.renameSync(backupTarget, rootInstalledTarget)
+      delete require.cache[rootPatchScript]
+    }
+  })
+
+  it('skips when the package is not installed locally', () => {
+    const backupTarget = `${rootInstalledTarget}.backup-${process.pid}`
+    fs.renameSync(rootInstalledTarget, backupTarget)
+
+    try {
+      delete require.cache[rootPatchScript]
+      require(rootPatchScript)
+      assert.strictEqual(fs.existsSync(rootInstalledTarget), false)
+    } finally {
+      fs.renameSync(backupTarget, rootInstalledTarget)
+      delete require.cache[rootPatchScript]
+    }
+  })
+
+  it('does not patch dependencies from the parent application', async () => {
+    const packageRoot = path.join(fixtureDirectory, 'node_modules', 'dd-trace')
+    createSourceFixture(packageRoot)
+
+    const parentTarget = path.join(fixtureDirectory, 'node_modules', 'istanbul-lib-coverage', relativeTarget)
+    fs.mkdirSync(path.dirname(parentTarget), { recursive: true })
+    const sourceTarget = path.join(
+      repoRoot, 'vendor', 'node_modules', 'istanbul-lib-coverage', relativeTarget
+    )
+    fs.copyFileSync(sourceTarget, parentTarget)
+    const originalParentSource = fs.readFileSync(parentTarget, 'utf8')
+
+    execFileSync(process.execPath, ['scripts/patch-istanbul-lib-coverage.js'], {
+      cwd: packageRoot,
+    })
+
+    assert.strictEqual(
+      await Promise.resolve(fs.readFileSync(parentTarget, 'utf8')),
+      originalParentSource
+    )
+  })
+})

scripts/test/patch-v8-to-istanbul.spec.js

@@ -0,0 +1,60 @@
+'use strict'
+
+const assert = require('node:assert/strict')
+const fs = require('node:fs')
+const path = require('node:path')
+
+const { replaceFile } = require('../replace-file')
+
+const repoRoot = path.resolve(__dirname, '..', '..')
+const patchScript = path.join(repoRoot, 'scripts', 'patch-v8-to-istanbul.js')
+const lineTarget = path.join(repoRoot, 'node_modules', 'v8-to-istanbul', 'lib', 'line.js')
+const applyTarget = path.join(repoRoot, 'node_modules', 'v8-to-istanbul', 'lib', 'v8-to-istanbul.js')
+const lineOriginal = `    // we start with all lines having been executed, and work
+    // backwards zeroing out lines based on V8 output.
+    this.count = 1`
+const applyOriginal = `          if (startCol <= line.startCol && endCol >= line.endCol && !line.ignore) {
+            line.count = range.count
+          }`
+
+describe('patch-v8-to-istanbul', () => {
+  let originalLineSource
+  let originalApplySource
+
+  beforeEach(() => {
+    originalLineSource = fs.readFileSync(lineTarget)
+    originalApplySource = fs.readFileSync(applyTarget)
+  })
+
+  afterEach(() => {
+    if (fs.existsSync(lineTarget)) {
+      replaceFile(lineTarget, originalLineSource)
+    } else {
+      fs.writeFileSync(lineTarget, originalLineSource)
+    }
+    replaceFile(applyTarget, originalApplySource)
+    delete require.cache[patchScript]
+  })
+
+  it('patches both local coverage files', () => {
+    replaceFile(lineTarget, lineOriginal)
+    replaceFile(applyTarget, applyOriginal)
+
+    delete require.cache[patchScript]
+    require(patchScript)
+
+    assert.match(fs.readFileSync(lineTarget, 'utf8'), /record firstColumn/)
+    assert.match(fs.readFileSync(applyTarget, 'utf8'), /zero lines covered from first non-whitespace column/)
+  })
+
+  it('skips a missing local coverage file', () => {
+    fs.rmSync(lineTarget)
+    replaceFile(applyTarget, applyOriginal)
+
+    delete require.cache[patchScript]
+    require(patchScript)
+
+    assert.strictEqual(fs.existsSync(lineTarget), false)
+    assert.match(fs.readFileSync(applyTarget, 'utf8'), /zero lines covered from first non-whitespace column/)
+  })
+})