Surfaced by review of #50.
ansible/molecule/validation/converge.yml:76 and :108 stage the deliberately-invalid binaries under:
{{ lookup('ansible.builtin.env', 'MOLECULE_PROJECT_DIRECTORY') }}/.molecule-badbin/target/release
MOLECULE_PROJECT_DIRECTORY is the same ansible/ directory for every scenario, so this is a fixed path on the control machine rather than per-run state, and the scenario's always: block removes it with state: absent.
Within a single make molecule run this is safe — validation is the only scenario that touches it (the others use the project dir read-only, via ANSIBLE_ROLES_PATH, ANSIBLE_COLLECTIONS_PATH and the shared stub at molecule/default/files/decdn-node-stub). The exposure is across runs, which used to be serialised by habit and no longer is: two overlapping make molecule invocations (a file-watcher, or a re-run started before the first finished) let run A's always: cleanup delete run B's staged pair mid-case.
When that happens the binary-format case fails on "file not found" instead of the ELF assert, and because the rescue: is gated on ansible_failed_task.name is match('^Require both binaries to be ELF'), the rejection is not recorded and the scenario fails with a misleading message.
Fix: stage under MOLECULE_EPHEMERAL_DIRECTORY instead, which is per-scenario and per-run. One-line change in both places.
Surfaced by review of #50.
ansible/molecule/validation/converge.yml:76and:108stage the deliberately-invalid binaries under:MOLECULE_PROJECT_DIRECTORYis the sameansible/directory for every scenario, so this is a fixed path on the control machine rather than per-run state, and the scenario'salways:block removes it withstate: absent.Within a single
make moleculerun this is safe —validationis the only scenario that touches it (the others use the project dir read-only, viaANSIBLE_ROLES_PATH,ANSIBLE_COLLECTIONS_PATHand the shared stub atmolecule/default/files/decdn-node-stub). The exposure is across runs, which used to be serialised by habit and no longer is: two overlappingmake moleculeinvocations (a file-watcher, or a re-run started before the first finished) let run A'salways:cleanup delete run B's staged pair mid-case.When that happens the
binary-formatcase fails on "file not found" instead of the ELF assert, and because therescue:is gated onansible_failed_task.name is match('^Require both binaries to be ELF'), the rejection is not recorded and the scenario fails with a misleading message.Fix: stage under
MOLECULE_EPHEMERAL_DIRECTORYinstead, which is per-scenario and per-run. One-line change in both places.