TIA: a run that overlaps a commit records a passing result for code it never executed

#!/usr/bin/env bash
#
# Minimal reproduction: Pest 5 TIA records a green result for code it never executed.
#
# Scenario: a second process commits while a `--tia` run is in flight. The run stamps
# HEAD read at the END of the run as its recorded baseline, so the other process's commit
# becomes the label on results produced from pre-commit code. Every later `--tia` run then
# sees "nothing changed since the recorded commit" and replays the stale green.
#
# The run that does this takes about ONE SECOND -- it is a replay whose affected set is
# non-empty, which activates the recorder and takes the same end-of-run stamping path.
#
# Timing is a file handshake, not a sleep, so the commit lands strictly mid-run every time.
#
# Requires: PHP 8.4+, composer, git, and a coverage driver (xdebug or pcov).
# Runs entirely in a temp directory; touches nothing else. ~40s, most of it composer.

set -euo pipefail

DIR=$(mktemp -d)
echo "working in $DIR"
cd "$DIR"

mkdir -p src tests

cat > composer.json <<'JSON'
{
    "name": "repro/tia-midrun-commit",
    "require-dev": { "pestphp/pest": "^5.1" },
    "autoload": { "psr-4": { "Repro\\": "src/" } },
    "config": { "allow-plugins": { "pestphp/pest-plugin": true } }
}
JSON

cat > phpunit.xml <<'XML'
<?xml version="1.0" encoding="UTF-8"?>
<phpunit bootstrap="vendor/autoload.php" colors="true">
    <testsuites>
        <testsuite name="Tests"><directory suffix="Test.php">tests</directory></testsuite>
    </testsuites>
    <source><include><directory suffix=".php">src</directory></include></source>
</phpunit>
XML

cat > src/Calculator.php <<'PHP'
<?php

declare(strict_types=1);

namespace Repro;

final class Calculator
{
    public function add(int $a, int $b): int
    {
        return $a + $b;
    }
}
PHP

cat > tests/AddTest.php <<'PHP'
<?php

declare(strict_types=1);

use Repro\Calculator;

it('adds two numbers', function (): void {
    expect((new Calculator())->add(2, 2))->toBe(4);
});
PHP

# Blocks mid-run so a second process can commit at a deterministic point.
cat > tests/HandshakeTest.php <<'PHP'
<?php

declare(strict_types=1);

use Repro\Calculator;

it('holds the run open', function (): void {
    expect((new Calculator())->add(1, 1))->toBeInt(); // depend on the same source file

    $sig = getenv('REPRO_SIG');

    if (is_string($sig) && $sig !== '') {
        touch($sig.'/reached');
        $deadline = microtime(true) + 20.0;
        while (! file_exists($sig.'/committed') && microtime(true) < $deadline) {
            usleep(50_000);
        }
    }
});
PHP

printf 'vendor/\n' > .gitignore

composer install --quiet --no-interaction

git init -q -b main
git config user.email repro@example.test
git config user.name  "TIA Repro"
git config init.defaultBranch main
git remote add origin https://github.com/example/tia-repro.git   # TIA requires a remote
git add -A && git commit -qm "baseline"

SIG="$DIR/sig"; mkdir -p "$SIG"

echo
echo "=== 1. record the TIA baseline ==============================================="
XDEBUG_MODE=coverage vendor/bin/pest --tia >/dev/null 2>&1 || true
echo "    recorded at $(git rev-parse --short HEAD)"

echo
echo "=== 2. a real source change, committed -- makes both tests 'affected' ========"
sed -i.bak 's/return \$a + \$b;/return \$a + \$b + 0;/' src/Calculator.php && rm -f src/Calculator.php.bak
git add -A && git commit -qm "a change that makes the tests affected"
echo "    HEAD is now $(git rev-parse --short HEAD)"

echo
echo "=== 3. run --tia; a SECOND PROCESS COMMITS while it is in flight ============="
(
  deadline=$(( $(date +%s) + 25 ))
  while [[ ! -f "$SIG/reached" && $(date +%s) -lt $deadline ]]; do sleep 0.05; done
  if [[ ! -f "$SIG/reached" ]]; then echo "    !! handshake failed, repro inconclusive"; touch "$SIG/committed"; exit 1; fi
  cd "$DIR"
  cat > src/Calculator.php <<'PHP'
<?php

declare(strict_types=1);

namespace Repro;

final class Calculator
{
    public function add(int $a, int $b): int
    {
        return $a + $b + 1000; // the other process's change -- BREAKS AddTest
    }
}
PHP
  git add -A && git commit -qm "second process: breaks add() mid-run"
  echo "    second process committed $(git rev-parse --short HEAD) mid-run"
  touch "$SIG/committed"
) &
WATCHER=$!

START=$(date +%s)
REPRO_SIG="$SIG" XDEBUG_MODE=coverage vendor/bin/pest --tia 2>&1 | tail -3
echo "    ^ that run took $(( $(date +%s) - START ))s"
wait $WATCHER || true

echo
echo "=== 4. what TIA recorded ====================================================="
KEY=$(php -r 'require "vendor/autoload.php"; echo basename(Pest\Plugins\Tia\Storage::tempDir(getcwd()));')
php -r '
$g = json_decode(file_get_contents(getenv("HOME")."/.pest/tia/'"$KEY"'/graph.json"), true);
echo "    graph recorded_at_sha = ".substr($g["baselines"]["main"]["sha"], 0, 7)."\n";'
echo "    actual HEAD           = $(git rev-parse --short HEAD)"
echo "    ^ if these match, TIA has labelled its results with a commit it never executed"

echo
echo "=== 4b. the contract break, measured from TIA's OWN recorded edges ==========="
php -r '
$g = json_decode(file_get_contents(getenv("HOME")."/.pest/tia/'"$KEY"'/graph.json"), true);
$idx = array_search("src/Calculator.php", $g["files"], true);
$dependents = [];
foreach ($g["edges"] as $testFile => $fileIdx) {
    if (in_array($idx, $fileIdx, true)) { $dependents[] = $testFile; }
}
echo "    the mid-run commit modified : src/Calculator.php\n";
echo "    tests TIA itself recorded as depending on it: ".count($dependents)."\n";
foreach ($dependents as $d) { echo "      - $d\n"; }
'
RECORDED_SHA=$(php -r '
$g = json_decode(file_get_contents(getenv("HOME")."/.pest/tia/'"$KEY"'/graph.json"), true);
echo $g["baselines"]["main"]["sha"];')
CHANGED_SINCE=$(git diff --name-only "$RECORDED_SHA" | wc -l | tr -d ' ')
echo "    changed files git reports since that recorded baseline: $CHANGED_SINCE"
echo "    ^ TIA had itself recorded those tests as covering the changed file, yet computes"
echo "      an empty changed-set from its own baseline. Step 5 shows the consequence:"
echo "      every test is replayed and none is re-run."

echo
echo "=== 5. the bug ==============================================================="
strip() { sed $'s/\033\\[[0-9;]*m//g'; }
echo -n "    pest --tia : "; XDEBUG_MODE=coverage vendor/bin/pest --tia 2>&1 | strip | grep -E "Tests:" | sed 's/^ *//'
echo -n "    pest       : "; vendor/bin/pest 2>&1 | strip | grep -E "Tests:" | sed 's/^ *//'
echo
echo "    --tia reports green; the same suite without --tia fails."
echo "    The green persists across repeated --tia runs; only a non-TIA run clears it."
echo
echo "    (clean up:  rm -rf $DIR  and  rm -rf ~/.pest/tia/$KEY)"