ENG-1643: Add end-to-end integration test for encrypted publish and install

[mitchell-as]

ENG-1643: Add end-to-end integration test for encrypted publish and install

The acceptance test for the private ingredient work (ENG-1563). It exercises the full encrypted round trip: build and publish a protected package from local source, then install it and confirm the decrypted content lands in the runtime.

TestPublishBuildEncrypted publishes a tiny Python package (carrying a unique sentinel) with state publish --build, installs it, then reads the decrypted wheel back out of the depot and checks for the sentinel — something only the plaintext could contain. The org key is handed to both sides through an environment variable, so the test needs no HTTPS key service.

Getting the round trip to pass surfaced a few production fixes along the way: state publish --build now depends on the private-builder (the default builder produced an empty artifact) and wraps only the encrypted payload, the consume side finds and decrypts that payload even when the builder nests it under the install directory, and the payload filename is now a single shared constant across the produce and consume sides.

Base branch: targets mitchell/eng-1634; GitHub will retarget it to version/0-48-1-RC2 once the upstream PRs land.

🤖 Generated with Claude Code

[mitchell-as]

The test failures are sporadic ones around the publish endpoint. The only test that matters is the new one, which passes:

✅ TestPublishIntegrationTestSuite/TestPublishBuildEncrypted (32.48s)

[Copilot]

Pull request overview

Adds coverage for the “private ingredient” encrypted publish/install workflow by introducing an end-to-end integration test and the necessary supporting production changes so encrypted payloads can be produced, located, decrypted, and installed correctly.

Changes:

• Add an integration test that publishes a locally-built encrypted Python ingredient, installs it, and verifies decrypted contents via a sentinel.
• Standardize encrypted payload discovery/placement: shared payload filename constant, recursive payload search on install, and extraction alongside the ciphertext path.
• Enable headless/dev testing by allowing org-key contracts to be supplied via an environment variable, and ensure --build publishes depend on the private-builder.

Reviewed changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
test/integration/publish_int_test.go	Adds E2E test for encrypted publish/install and depot sentinel verification helpers
pkg/runtime/setup.go	Updates encrypted payload discovery and ensures decrypted extraction lands where runtime layout expects
pkg/runtime/decrypt_test.go	Expands unit tests for recursive payload discovery and nested extraction behavior
internal/runners/publish/publish.go	Forces --build publishes to depend on private-builder to avoid empty artifacts
internal/runners/publish/build.go	Builds/wraps encrypted payload using a shared payload filename; removes cleartext runtime.json wrapping
internal/runners/publish/build_test.go	Updates expectations for wrapped artifact contents and payload layout
internal/runbits/orgkey/https.go	Allows reading/validating org-key contract directly from an env var (bypassing HTTPS service)
internal/runbits/orgkey/env.go	Ensures org-key contract env var is not leaked to child processes
internal/constants/constants.go	Introduces env var name constant for injecting an org-key contract
internal/artifactcrypto/artifactcrypto.go	Introduces shared PayloadFilename constant used by producer/consumer

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[mitchell-as]

Note: "install" is misleading. State Tool installs the decrypted wheel by linking to it from the runtime for now. We only recently learned that we want to do a proper wheel install into the runtime, and that will be in its own ticket.