fix(compose): serialize concurrent CoreDNS renders

Parallel `make test` targets each auto-ran `compose-up`, which rendered
into a fixed Corefile.tmp; the first replace() stole the file from the
others and surfaced as "envsubst did not produce an output file".
mkstemp per process plus a flock'd re-check in the test wrapper so only
one target brings the stack up.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

cli/administration/deploy/development/coredns.py

@@ -4,14 +4,12 @@ import itertools
 import os
 import shutil
 import subprocess
+import tempfile
 from dataclasses import dataclass
-from typing import TYPE_CHECKING
+from pathlib import Path
 
 from utils.env.parser import parse_static_env
 
-if TYPE_CHECKING:
-    from pathlib import Path
-
 
 @dataclass(frozen=True)
 class CoreDNSCorefileRenderer:
@@ -116,13 +114,16 @@ class CoreDNSCorefileRenderer:
 
         env = self._load_env_file(env_file)
 
-        tmp_file = out_file.with_suffix(out_file.suffix + ".tmp")
+        fd, tmp_name = tempfile.mkstemp(
+            dir=out_file.parent, prefix=out_file.name + ".", suffix=".tmp"
+        )
+        tmp_file = Path(tmp_name)
 
         self._log("Rendering Corefile via envsubst (atomic write)")
         try:
             with (
                 tmpl_file.open("r", encoding="utf-8") as fin,
-                tmp_file.open("w", encoding="utf-8") as fout,
+                os.fdopen(fd, "w", encoding="utf-8") as fout,
             ):
                 subprocess.check_call(
                     [envsubst],
@@ -131,19 +132,19 @@ class CoreDNSCorefileRenderer:
                     env=env,
                     cwd=self.repo_root,
                 )
+
+            size = tmp_file.stat().st_size
+            if size == 0:
+                raise RuntimeError(f"Rendered Corefile is empty: {tmp_file}")
+
+            tmp_file.replace(out_file)
         except OSError as exc:
             raise RuntimeError(
                 f"Failed to write temporary Corefile: {tmp_file}"
             ) from exc
+        finally:
+            tmp_file.unlink(missing_ok=True)
 
-        if not tmp_file.exists():
-            raise RuntimeError("envsubst did not produce an output file")
-
-        size = tmp_file.stat().st_size
-        if size == 0:
-            raise RuntimeError(f"Rendered Corefile is empty: {tmp_file}")
-
-        tmp_file.replace(out_file)
         self._log(f"Rendered successfully ({size} bytes)")
 
         if show_preview:

scripts/tests/code/wrapper.sh

@@ -10,9 +10,6 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 REPO_ROOT="$(cd "${SCRIPT_DIR}/../../.." && pwd)"
 RUN_SCRIPT="${SCRIPT_DIR}/run.sh"
 
-# Pull project-wide defaults (INFINITO_SRC_DIR, INFINITO_TEST_PATTERN, ...)
-# from the generated `.env` (single source of truth) before validating
-# anything else, so the :?-checks below see the static defaults.
 cd "${REPO_ROOT}"
 # shellcheck source=scripts/meta/env/load.sh
 source scripts/meta/env/load.sh
@@ -25,30 +22,16 @@ RUN_SCRIPT_IN_CONTAINER="${INFINITO_SRC_DIR}/scripts/tests/code/run.sh"
 
 case "${INFINITO_TEST_RUNNER}" in
 docker)
-	# INFINITO_DISTRO is sourced (with a `debian` default) from
-	# scripts/meta/env/load.sh above, so no explicit check here.
 	echo "============================================================"
 	echo ">>> Running ${INFINITO_TEST_TYPE^^} tests in ${INFINITO_DISTRO} container (compose stack)" # nocheck: makefile-supplied
 	echo "============================================================"
 
-	# Auto-bring-up: if the `infinito` container is not running, kick off
-	# `make compose-up` first so test-* doesn't fail with "service not running".
 	if ! docker compose ps -q infinito 2>/dev/null | grep -q .; then
 		echo ">>> 'infinito' container not running; starting the stack via 'make compose-up'..."
-		"${MAKE:-make}" compose-up
+		flock "${REPO_ROOT}/.compose-up.lock" \
+			bash -c 'docker compose ps -q infinito 2>/dev/null | grep -q . || exec "${MAKE:-make}" compose-up'
 	fi
 
-	# Compose auto-loads `.env` (the SPOT generated from default.env),
-	# which carries every INFINITO_* default (INFINITO_DNS_IP, INFINITO_IP4,
-	# INFINITO_DOMAIN, INFINITO_CONTAINER, INFINITO_SUBNET, ...).
-	# BASH_ENV makes `bash --login` source load.sh on startup, pulling
-	# every INFINITO_* key from the bind-mounted .env into the test
-	# runner's environment (notably INFINITO_WORKER_FETCH, otherwise the
-	# external URL probe collapses to 1 worker).
-	# Per-invocation env passed through docker exec. Built as a bash
-	# array so the inline `# nocheck:` markers between elements stay
-	# syntactically valid (a backslash-continued line cannot host an
-	# inline comment).
 	exec_env_args=(
 		-e ACT="${ACT:-}"
 		-e BASH_ENV="${INFINITO_SRC_DIR}/scripts/meta/env/load.sh"