From fe25262e60209477e9b46726607b5f3eba74f75d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robin=20Br=C3=A4mer?=
 <22003767+robinbraemer@users.noreply.github.com>
Date: Thu, 13 Aug 2026 23:35:21 +0200
Subject: [PATCH] fix: run trusted catalog tests from trusted root

---
 .github/workflows/runner-catalog-trusted.yml  | 2 +-
 script/check_runner_catalog_trust_boundary.rb | 2 +-
 test/runner_catalog_trust_boundary_test.rb    | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/runner-catalog-trusted.yml b/.github/workflows/runner-catalog-trusted.yml
index a68e8b8..34d528d 100644
--- a/.github/workflows/runner-catalog-trusted.yml
+++ b/.github/workflows/runner-catalog-trusted.yml
@@ -115,7 +115,7 @@ jobs:
       - name: Verify trusted boundary
         run: ruby .trusted/script/check_runner_catalog_trust_boundary.rb --trusted-root .trusted --candidate-root .candidate
       - name: Exercise base-owned infrastructure
-        run: ruby .trusted/test/runner_catalog_test.rb && ruby .trusted/test/runner_catalog_lifecycle_test.rb && ruby .trusted/test/runner_catalog_trust_boundary_test.rb
+        run: cd .trusted && ruby test/runner_catalog_test.rb && ruby test/runner_catalog_lifecycle_test.rb && ruby test/runner_catalog_trust_boundary_test.rb
       - name: Check catalog lifecycle
         id: lifecycle
         run: echo "action=$(ruby .trusted/script/check_runner_catalog_lifecycle.rb --previous-root .trusted --current-root .candidate)" >> "$GITHUB_OUTPUT"
diff --git a/script/check_runner_catalog_trust_boundary.rb b/script/check_runner_catalog_trust_boundary.rb
index 600ca92..141f23b 100644
--- a/script/check_runner_catalog_trust_boundary.rb
+++ b/script/check_runner_catalog_trust_boundary.rb
@@ -88,7 +88,7 @@ def validate_workflow_model!(workflow)
     fail_with("trusted source checkout missing") unless source_index
     fail_with("trusted workflow boundary ordering drift") unless boundary_index < source_index && tests_index < source_index
     fail_with("trusted boundary must use base-owned files") unless steps.fetch(boundary_index).fetch("run") == "ruby .trusted/script/check_runner_catalog_trust_boundary.rb --trusted-root .trusted --candidate-root .candidate"
-    fail_with("base-owned tests must use trusted files") unless steps.fetch(tests_index).fetch("run") == "ruby .trusted/test/runner_catalog_test.rb && ruby .trusted/test/runner_catalog_lifecycle_test.rb && ruby .trusted/test/runner_catalog_trust_boundary_test.rb"
+    fail_with("base-owned tests must run from trusted root") unless steps.fetch(tests_index).fetch("run") == "cd .trusted && ruby test/runner_catalog_test.rb && ruby test/runner_catalog_lifecycle_test.rb && ruby test/runner_catalog_trust_boundary_test.rb"
   end
 
   def fail_with(message)
diff --git a/test/runner_catalog_trust_boundary_test.rb b/test/runner_catalog_trust_boundary_test.rb
index 05ade53..2ed5349 100644
--- a/test/runner_catalog_trust_boundary_test.rb
+++ b/test/runner_catalog_trust_boundary_test.rb
@@ -81,7 +81,7 @@ def workflow
           "if" => "github.event_name == 'pull_request_target'",
           "steps" => [
             { "name" => "Verify trusted boundary", "run" => "ruby .trusted/script/check_runner_catalog_trust_boundary.rb --trusted-root .trusted --candidate-root .candidate" },
-            { "name" => "Exercise base-owned infrastructure", "run" => "ruby .trusted/test/runner_catalog_test.rb && ruby .trusted/test/runner_catalog_lifecycle_test.rb && ruby .trusted/test/runner_catalog_trust_boundary_test.rb" },
+            { "name" => "Exercise base-owned infrastructure", "run" => "cd .trusted && ruby test/runner_catalog_test.rb && ruby test/runner_catalog_lifecycle_test.rb && ruby test/runner_catalog_trust_boundary_test.rb" },
             { "name" => "Checkout canonical runner source", "uses" => "actions/checkout@v6", "with" => { "repository" => "akua-dev/gitops", "token" => "${{ secrets.GITOPS_READ_TOKEN }}" } }
           ]
         }