rclone/docs/plans/001-protondrive-tier1-workspace/task-18-brief.md

Task 18: Wider hermetic suites and fork CI

Files:

• Create: fstest/testserver/init.d/TestProtonDriveFake
• Modify: fstest/testserver/init.d/PORTS.md
• Modify: fstest/test_all/config.yaml (add backend protondrive remote TestProtonDriveFake: entry, fastlist: false)
• Create: .gitea/workflows/ci.yml
• Modify: docs/TODO.md, docs/PERMISSIONS.md

Model the init.d script on fstest/testserver/init.d/TestWebdavRclone (rclone-serve.bash/run.bash helpers): start protonfake on a port allocated in PORTS.md, echo its key=value lines and _connect=127.0.0.1:PORT.

Read "Notes for Tasks 18 to 21" in the handoff before starting: this text leaves out how the script obtains protonfake's output and manages its process, and the commands below need RCLONE_CONFIG=/notfound.

• Step 1: Add the script and config entry. Run go run ./fstest/test_all -backends protondrive -remotes TestProtonDriveFake: -maxtries 1 -n 4 and fix backend failures in fs/operations, fs/sync, vfs until the report is clean. cmd/bisync and cmd/gitannex: run them; if they fail for reasons that need M5/M6 work, add ignoretests for those two on the fake remote and list the failures in docs/TODO.md.
• Step 2: .gitea/workflows/ci.yml on push and pull request: actions/setup-go with go-version-file: go.mod; steps go build ./...; go vet ./backend/protondrive/...; golangci-lint run ./backend/protondrive/...; go test -race ./backend/protondrive/...; a 20s fuzz run per target; go run golang.org/x/vuln/cmd/govulncheck@latest ./backend/protondrive/.... It cannot be verified locally: say so in docs/TODO.md ("first push must confirm the Gitea runner picks it up").
• Step 3: Update docs/PERMISSIONS.md verified-commands table for the host toolchain (Go 1.27.4, golangci-lint 2.15.0) and add golangci-lint run to the Allow tier in it and in the three tool files.
• Step 4: Commit protondrive: run the wider suites against the fake server in fork CI.