feat(quickstack): inherit app runtime configuration safely

.gitea/actions/quickstack-oci/deploy.test.mjs

@@ -2,10 +2,13 @@ import assert from "node:assert/strict";
 import test from "node:test";
 
 import {
+  applyVolumeMountPaths,
   classifyVersion2Execution,
   deployExactImage,
   expandTokens,
   mergeEnvironment,
+  normalizeVolumeMountPaths,
+  parseEnvironment,
   resolveActionMode,
   resolveArtifactIndex,
   resolveBuildSecretArguments,
@@ -162,6 +165,15 @@ test("version 2 validates promotion contracts and token expansion", () => {
     () => validateApplication({ name: "web", artifact: "missing", appId: "app" }, new Set(["known"])),
     /unknown artifact/,
   );
+  assert.throws(
+    () => validateApplication({
+      name: "worker",
+      artifact: "known",
+      appId: "app-worker",
+      environmentFromAppId: "app-worker",
+    }, new Set(["known"])),
+    /cannot inherit environment from itself/,
+  );
 });
 
 test("passes declared Actions secrets to Docker only through BuildKit secret mounts", () => {
@@ -210,6 +222,26 @@ test("preserves response-only fields and existing environment secrets safely", (
   const payload = toSavePayload(app());
   assert.equal(payload.createdAt, undefined);
   assert.equal(mergeEnvironment(app().envVars, { ENVIRONMENT: "new" }), "SECRET=preserved\nENVIRONMENT=new");
+  assert.deepEqual(parseEnvironment("SECRET=preserved\nAPP_DEPLOYMENT_ID=source\nENVIRONMENT=new\ninvalid line"), {
+    SECRET: "preserved",
+    ENVIRONMENT: "new",
+  });
+});
+
+test("overrides only declared existing QuickStack volume mount paths", () => {
+  const volumes = [
+    { id: "volume-local", sharedVolumeId: "shared-volume", containerMountPath: "/old" },
+    { id: "volume-untouched", containerMountPath: "/data" },
+  ];
+  assert.deepEqual(
+    applyVolumeMountPaths(volumes, { "shared-volume": "/mnt/as4" }),
+    [
+      { id: "volume-local", sharedVolumeId: "shared-volume", containerMountPath: "/mnt/as4" },
+      { id: "volume-untouched", containerMountPath: "/data" },
+    ],
+  );
+  assert.throws(() => applyVolumeMountPaths(volumes, { missing: "/mnt/data" }), /not found/);
+  assert.throws(() => normalizeVolumeMountPaths({ volume: "../data" }), /safe absolute path/);
 });
 
 test("maps only explicitly declared Actions secrets into runtime environment", () => {