Summary

• Ensures the remote custom registry integration test syncs the builtin platform registry before workflow execution.
• Detects and replaces/promotes away from the placeholder builtin tarball URI (s3://test/test.tar.gz).
• Makes registry lock setup idempotent for platform registry rows used by xdist/unit tests.
• Preserves an already-selected live platform registry version in registry_version_with_manifest, so temporal/integration tests do not clobber the API-synced builtin tarball with the fake fixture version.

Root Cause

Commit 5d1d745c1 made resolved workflow locks always include tracecat_registry as a runtime dependency. The remote custom registry test synced only the custom repo, so executor setup could try to download the builtin fixture placeholder tarball and fail with a 404.

The additional CI failures came from tests assuming platform registry setup was isolated/idempotent. Platform registry rows are global by origin, so parallel setup could collide on tracecat_registry, and the shared manifest fixture could overwrite a live platform registry current version with test-version and the fake tarball.

Validation

• uv run pytest tests/unit/test_registry_lock_resolution.py -n 4
• uv run pytest --collect-only -q tests/temporal/test_large_collection_regressions.py tests/integration/test_install_and_run_custom_remote_registry_flow.py
• uv run ruff check tests/conftest.py tests/unit/test_registry_lock_resolution.py tests/integration/test_install_and_run_custom_remote_registry_flow.py
• uv run ruff format --check tests/conftest.py tests/unit/test_registry_lock_resolution.py tests/integration/test_install_and_run_custom_remote_registry_flow.py
• uv run basedpyright tests/conftest.py tests/unit/test_registry_lock_resolution.py tests/integration/test_install_and_run_custom_remote_registry_flow.py

CI is green for Ruff, Pyright, unit, registry, temporal, integration, custom registry install, CodeQL, Semgrep, and Terraform Cloud.

Summary by cubic

Fixes the remote custom registry integration test by syncing the builtin platform registry and ensuring a real tarball is selected, so tracecat_registry resolves to a downloadable tarball and executor setup avoids 404s. Also makes registry setup idempotent, repairs missing current selections at startup, and applies a safe fixture fallback in shared DBs.

• Bug Fixes
  • Syncs the builtin platform registry (DEFAULT_REGISTRY_ORIGIN) before the workflow; creates it if missing, forces sync when needed, and promotes a version with a real tarball when the placeholder is current.
  • Safe fixture fallback: in per-test DBs, select the fixture platform version; in the default/shared DB, select it only if no current exists or it already matches the fixture; otherwise, wait for API/startup to select the live builtin version.
  • Makes platform setup idempotent: upserts repositories by origin (unique non-default origins), generates unique versions/tarballs, and reuses an existing current for the default repo; startup sync repairs a missing current pointer when the target version already exists.
  • Adds an early lock-resolution check and raises BuiltinRegistryHasNoSelectionError when the builtin has no selected version, so tests and workflows retry while sync is pending.

^{Written for commit dfe91a6. Summary will update on new commits.}