fix: harden workspace registry deployment

backend/test/workspaces-migrate-legacy.test.ts

@@ -1,9 +1,10 @@
-import { existsSync, readFileSync, rmSync } from "node:fs";
+import { existsSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { mkdtemp } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { afterEach, expect, test } from "vitest";
 import {
+  main,
   migrateLegacyWorkspace,
   writeMigratedWorkspace,
 } from "../src/workspaces/migrate-legacy.js";
@@ -48,13 +49,29 @@ test("writes versioned repository artifacts atomically without replacing a prior
   expect(existsSync(destination)).toBe(true);
 });
 
+test("CLI accepts an explicit valid ID when a legacy filename contains dots", async () => {
+  const root = await mkdtemp(join(tmpdir(), "thoth-workspace-migrate-"));
+  temporaryRoots.push(root);
+  const input = join(root, "psd.clinical.yaml");
+  writeFileSync(input, readFixture("local.yaml"));
+
+  await main(["--input", input, "--output", root, "--id", "psd-clinical"]);
+
+  const destination = join(root, "workspaces", "psd-clinical.yaml");
+  expect(parseWorkspaceYaml(readFileSync(destination, "utf8"))).toMatchObject({
+    workspace: { id: "psd-clinical", schema_version: 1 },
+  });
+});
+
 test("declares a durable isolated registry volume and only read-only Git credential mounts", () => {
   const compose = readFileSync(new URL("../../compose.yaml", import.meta.url), "utf8");
   const development = readFileSync(new URL("../../docker-compose.dev.yml", import.meta.url), "utf8");
   const dockerfile = readFileSync(new URL("../../docker/core.Dockerfile", import.meta.url), "utf8");
+  const smoke = readFileSync(new URL("../../scripts/workspace-registry-smoke.sh", import.meta.url), "utf8");
 
   for (const source of [compose, development]) {
     expect(source).toContain("THT_WORKSPACE_REGISTRY_ROOT: /data/workspace-registry");
+    expect(source).toContain("THT_WORKSPACE_GIT_REMOTE: ${THT_WORKSPACE_GIT_REMOTE:?set THT_WORKSPACE_GIT_REMOTE}");
     expect(source).toContain("workspace-registry:/data/workspace-registry");
     expect(source).toMatch(/workspace-registry-git-credentials:ro/);
     expect(source).toMatch(/workspace-registry-git-ca:ro/);
@@ -62,4 +79,7 @@ test("declares a durable isolated registry volume and only read-only Git credent
     expect(source).toMatch(/workspace-registry-git-known-hosts:ro/);
   }
   expect(dockerfile).toMatch(/mkdir -p \/data\/workspace-registry && chown -R thoth:thoth \/data\/workspace-registry/);
+  expect(smoke).toContain('core_remote="/fixtures/offline.git"');
+  expect(smoke).toContain('"degraded":true');
+  expect(smoke).toContain('core_remote="/fixtures/remote.git"');
 });