fix: only mount global files in configure command (#2377)

JoeWang1127 · web-flow · commit 1a2aaa0afaac · 2025-09-29T09:43:06.000-04:00
According to [configure container contract](https://github.com/googleapis/librarian/blob/main/doc/language-onboarding.md#configure), the `/repo` volume should only contain global files defined in global files allowlist in librarian config. Updates #1922
diff --git a/internal/config/librarian_config.go b/internal/config/librarian_config.go
@@ -74,3 +74,13 @@ func (g *LibrarianConfig) LibraryConfigFor(LibraryID string) *LibraryConfig {
 	}
 	return nil
 }
+
+// GetGlobalFiles returns the global files defined in the librarian config.
+func (g *LibrarianConfig) GetGlobalFiles() []string {
+	var globalFiles []string
+	for _, globalFile := range g.GlobalFilesAllowlist {
+		globalFiles = append(globalFiles, globalFile.Path)
+	}
+
+	return globalFiles
+}
diff --git a/internal/config/librarian_config_test.go b/internal/config/librarian_config_test.go
@@ -166,3 +166,55 @@ func TestLibraryConfigFor(t *testing.T) {
 		})
 	}
 }
+
+func TestGetGlobalFiles(t *testing.T) {
+	for _, test := range []struct {
+		name   string
+		config *LibrarianConfig
+		want   []string
+	}{
+		{
+			name: "get_global_files",
+			config: &LibrarianConfig{
+				GlobalFilesAllowlist: []*GlobalFile{
+					{
+						Path:        "a/path",
+						Permissions: "read-only",
+					},
+					{
+						Path:        "another/path",
+						Permissions: "write-only",
+					},
+					{
+						Path:        "other/paths",
+						Permissions: "read-write",
+					},
+				},
+			},
+			want: []string{
+				"a/path",
+				"another/path",
+				"other/paths",
+			},
+		},
+		{
+			name: "empty_global_files",
+			config: &LibrarianConfig{
+				GlobalFilesAllowlist: []*GlobalFile{},
+			},
+			want: nil,
+		},
+		{
+			name:   "nil_global_files",
+			config: &LibrarianConfig{},
+			want:   nil,
+		},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			got := test.config.GetGlobalFiles()
+			if diff := cmp.Diff(test.want, got); diff != "" {
+				t.Errorf("GetGlobalFiles() mismatch (-want +got):\n%s", diff)
+			}
+		})
+	}
+}
diff --git a/internal/docker/docker.go b/internal/docker/docker.go
@@ -97,6 +97,9 @@ type ConfigureRequest struct {
 	// RepoDir is the local root directory of the language repository.
 	RepoDir string
 
+	// GlobalFiles are global files of the language repository.
+	GlobalFiles []string
+
 	// State is a pointer to the [config.LibrarianState] struct, representing
 	// the overall state of the generation and release pipeline.
 	State *config.LibrarianState
@@ -279,9 +282,12 @@ func (c *Docker) Configure(ctx context.Context, request *ConfigureRequest) (stri
 	mounts := []string{
 		fmt.Sprintf("%s:/librarian", librarianDir),
 		fmt.Sprintf("%s:/input", generatorInput),
-		fmt.Sprintf("%s:/repo", request.RepoDir),
 		fmt.Sprintf("%s:/source:ro", request.ApiRoot), // readonly volume
 	}
+	// Mount global files as a readonly volume.
+	for _, globalFile := range request.GlobalFiles {
+		mounts = append(mounts, fmt.Sprintf("%s/%s:/repo/%s:ro", request.RepoDir, globalFile, globalFile))
+	}
 
 	if err := c.runDocker(ctx, request.HostMount, CommandConfigure, mounts, commandArgs); err != nil {
 		return "", err
diff --git a/internal/docker/docker_test.go b/internal/docker/docker_test.go
@@ -243,6 +243,10 @@ func TestDockerRun(t *testing.T) {
 					LibraryID: testLibraryID,
 					RepoDir:   repoDir,
 					ApiRoot:   testAPIRoot,
+					GlobalFiles: []string{
+						"a/b/go.mod",
+						"go.mod",
+					},
 				}
 
 				_, err := d.Configure(ctx, configureRequest)
@@ -253,8 +257,9 @@ func TestDockerRun(t *testing.T) {
 				"run", "--rm",
 				"-v", fmt.Sprintf("%s/.librarian:/librarian", repoDir),
 				"-v", fmt.Sprintf("%s/.librarian/generator-input:/input", repoDir),
-				"-v", fmt.Sprintf("%s:/repo", repoDir),
 				"-v", fmt.Sprintf("%s:/source:ro", testAPIRoot),
+				"-v", fmt.Sprintf("%s/a/b/go.mod:/repo/a/b/go.mod:ro", repoDir),
+				"-v", fmt.Sprintf("%s/go.mod:/repo/go.mod:ro", repoDir),
 				testImage,
 				string(CommandConfigure),
 				"--librarian=/librarian",
@@ -264,7 +269,38 @@ func TestDockerRun(t *testing.T) {
 			},
 		},
 		{
-			name: "Configure with multiple libraries in librarian state",
+			name: "configure_with_nil_global_files",
+			docker: &Docker{
+				Image: testImage,
+			},
+			runCommand: func(ctx context.Context, d *Docker) error {
+				configureRequest := &ConfigureRequest{
+					State:       state,
+					LibraryID:   testLibraryID,
+					RepoDir:     repoDir,
+					ApiRoot:     testAPIRoot,
+					GlobalFiles: nil,
+				}
+
+				_, err := d.Configure(ctx, configureRequest)
+
+				return err
+			},
+			want: []string{
+				"run", "--rm",
+				"-v", fmt.Sprintf("%s/.librarian:/librarian", repoDir),
+				"-v", fmt.Sprintf("%s/.librarian/generator-input:/input", repoDir),
+				"-v", fmt.Sprintf("%s:/source:ro", testAPIRoot),
+				testImage,
+				string(CommandConfigure),
+				"--librarian=/librarian",
+				"--input=/input",
+				"--repo=/repo",
+				"--source=/source",
+			},
+		},
+		{
+			name: "configure_with_multiple_libraries_in_librarian_state",
 			docker: &Docker{
 				Image: testImage,
 			},
@@ -299,6 +335,10 @@ func TestDockerRun(t *testing.T) {
 					LibraryID: testLibraryID,
 					RepoDir:   repoDir,
 					ApiRoot:   testAPIRoot,
+					GlobalFiles: []string{
+						"a/b/go.mod",
+						"go.mod",
+					},
 				}
 
 				configuredLibrary, err := d.Configure(ctx, configureRequest)
@@ -312,8 +352,9 @@ func TestDockerRun(t *testing.T) {
 				"run", "--rm",
 				"-v", fmt.Sprintf("%s/.librarian:/librarian", repoDir),
 				"-v", fmt.Sprintf("%s/.librarian/generator-input:/input", repoDir),
-				"-v", fmt.Sprintf("%s:/repo", repoDir),
 				"-v", fmt.Sprintf("%s:/source:ro", testAPIRoot),
+				"-v", fmt.Sprintf("%s/a/b/go.mod:/repo/a/b/go.mod:ro", repoDir),
+				"-v", fmt.Sprintf("%s/go.mod:/repo/go.mod:ro", repoDir),
 				testImage,
 				string(CommandConfigure),
 				"--librarian=/librarian",
diff --git a/internal/librarian/generate.go b/internal/librarian/generate.go
@@ -359,12 +359,18 @@ func (r *generateRunner) runConfigureCommand(ctx context.Context) (string, error
 		return "", err
 	}
 
+	var globalFiles []string
+	if r.librarianConfig != nil {
+		globalFiles = r.librarianConfig.GetGlobalFiles()
+	}
+
 	configureRequest := &docker.ConfigureRequest{
-		ApiRoot:   apiRoot,
-		HostMount: r.hostMount,
-		LibraryID: r.library,
-		RepoDir:   r.repo.GetDir(),
-		State:     r.state,
+		ApiRoot:     apiRoot,
+		HostMount:   r.hostMount,
+		LibraryID:   r.library,
+		RepoDir:     r.repo.GetDir(),
+		GlobalFiles: globalFiles,
+		State:       r.state,
 	}
 	slog.Info("Performing configuration for library", "id", r.library)
 	if _, err := r.containerClient.Configure(ctx, configureRequest); err != nil {
diff --git a/internal/librarian/generate_test.go b/internal/librarian/generate_test.go
@@ -629,6 +629,33 @@ func TestGenerateScenarios(t *testing.T) {
 			wantBuildCalls:     1,
 			wantConfigureCalls: 1,
 		},
+		{
+			name:    "generate_single_library_with_librarian_config",
+			api:     "some/api",
+			library: "some-library",
+			state: &config.LibrarianState{
+				Image: "gcr.io/test/image:v1.2.3",
+			},
+			container: &mockContainerClient{
+				wantLibraryGen: true,
+				configureLibraryPaths: []string{
+					"src/a",
+				},
+			},
+			librarianConfig: &config.LibrarianConfig{
+				GlobalFilesAllowlist: []*config.GlobalFile{
+					{
+						Path:        "a/path/example.txt",
+						Permissions: "read-only",
+					},
+				},
+			},
+			ghClient:           &mockGitHubClient{},
+			build:              true,
+			wantGenerateCalls:  1,
+			wantBuildCalls:     1,
+			wantConfigureCalls: 1,
+		},
 		{
 			name:    "generate single existing library by library id",
 			library: "some-library",

Original file line number	Diff line number	Diff line change
`@@ -74,3 +74,13 @@ func (g LibrarianConfig) LibraryConfigFor(LibraryID string) LibraryConfig {`
`74`	`74`	`}`
`75`	`75`	`return nil`
`76`	`76`	`}`
	`77`	`+`
	`78`	`+// GetGlobalFiles returns the global files defined in the librarian config.`
	`79`	`+func (g *LibrarianConfig) GetGlobalFiles() []string {`
	`80`	`+ var globalFiles []string`
	`81`	`+ for _, globalFile := range g.GlobalFilesAllowlist {`
	`82`	`+ globalFiles = append(globalFiles, globalFile.Path)`
	`83`	`+ }`
	`84`	`+`
	`85`	`+ return globalFiles`
	`86`	`+}`