Fix purge_allowlist not respected in purgeControlRepoExceptModuledir

[Copilot]

purge_allowlist entries were silently ignored when g10k detected control repo changes and called purgeControlRepoExceptModuledir — everything except the module dir was deleted unconditionally, including user-managed directories like .resource_types.

Changes

• stale.go: Updated purgeControlRepoExceptModuledir to resolve config.PurgeAllowList glob patterns against the environment directory before purging, skipping matched entries — consistent with how purgeUnmanagedContent handles DeploymentPurgeAllowList
• g10k_test.go: Added TestPurgeControlRepoExceptModuledirWithAllowList unit test that verifies allowlisted paths (.resource_types, custom.json) survive purge while unlisted paths are removed
• tests/TestConfigPurgeAllowlistControlRepo.yaml: Test config for the new test

Example

# g10k.yaml
purge_allowlist: [ '.resource_types' ]

With this fix, .resource_types (or any other allowlisted path) is preserved when g10k resyncs an environment after a control repo change.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• forgeapi.puppet.com
  • Triggering command: /tmp/go-build623816492/b001/g10k.test /tmp/go-build623816492/b001/g10k.test -test.run=TestPurgeControlRepoExceptModuledir$ (dns block)
  • Triggering command: /tmp/go-build1277108894/b001/g10k.test /tmp/go-build1277108894/b001/g10k.test -test.paniconexit0 -test.v=true -test.run=TestPurgeControlRepoExceptModuledir$ -test.timeout=2m0s 0.1-go1.25.3.lin--gdwarf-5 /http/httptrace/trace.go ux-amd64/pkg/tool/linux_amd64/compile (dns block)
  • Triggering command: /tmp/go-build161923965/b001/g10k.test /tmp/go-build161923965/b001/g10k.test -test.run=TestPurgeControlRepoExceptModuledir$ (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

---

This section details on the original issue you should resolve

<issue_title>impossible to keep .resource_types directory</issue_title>
<issue_description>I've been struggling with optimizing our g10k pipeline here, partly because of #233 (where puppetfiles are checked even if unchanged, soon to be fixed!) but also more broadly because the entire environment seems to reset any time there's an update on the branch.

Here, for example, I can't figure out how to keep the .resource_types directory that we generate after we run g10k (i've tried to use r10k's deploy.generate_types but it seems to be ignored by g10k). I have tried:

deploy:
  purge_allowlist: [ '.resource_types', '.resource_types/**', ]
  deployment_purge_allowlist: [ '.resource_types', '.resource_types/**', ]

in our g10k.yaml and it doesn't work: g10k happily destroys the entire directory recursively regardless.

git@pauli:~$ grep resource_types g10k.trace.*
g10k.trace.81727:newfstatat(AT_FDCWD, "/etc/puppet/code/environments/g10khardening/.resource_types", {st_mode=S_IFDIR|0775, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
g10k.trace.81727:unlinkat(AT_FDCWD, "/etc/puppet/code/environments/g10khardening/.resource_types", 0) = -1 EISDIR (Is a directory)
g10k.trace.81727:unlinkat(AT_FDCWD, "/etc/puppet/code/environments/g10khardening/.resource_types", AT_REMOVEDIR) = -1 ENOTEMPTY (Directory not empty)
g10k.trace.81727:unlinkat(3, ".resource_types", 0)       = -1 EISDIR (Is a directory)
g10k.trace.81727:openat(3, ".resource_types", O_RDONLY|O_NOFOLLOW|O_CLOEXEC|O_DIRECTORY) = 7
g10k.trace.81727:unlinkat(3, ".resource_types", AT_REMOVEDIR) = 0

It's strange because that I couldn't find this removal -debug log output at first, but looking at strace output, it does indeed deliberately deletes that directory:

2026/01/21 17:09:17 DEBUG purgeControlRepoExceptModuledir(): deleting /etc/puppet/code/environments/g10khardening/.resource_types\n

It seems the problem might be that the function above doesn't respect the allow_list stuff:

https://github.com/xorpaul/g10k/blob/f91099adb1071e566a720478eb929d32d243880d/stale.go#L102-L118

In #115, there was an attempt to to preserve that directory that was shipped as 934c7c7 in the 0.5.5 release, years ago, but that code seems to have disappeared, presumably in favor of the above allow_list?

In any case, right now the situation is now similar to #115 again in that we need to constantly regenerate types. It's not catastrophic: it takes a couple of seconds, but it makes "git push" feel much slower than it should, which is distracting...

Thanks!</issue_description>

Comments on the Issue (you are @copilot in this section)

• Fixes impossible to keep .resource_types directory #244

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.