Add RecordingRunner and Execute() test suite; fix cache/persist bugs

internal/config/config/config.go

@@ -255,19 +255,17 @@ func (c *Config) readMixin(mixin *Mixin) error {
 		if data == nil {
 			downloadedData, downloadErr := rm.download(c.context(), c.downloadProgress)
 			if downloadErr != nil {
-				if c.noCache {
-					cachedData, readErr := rm.tryRead()
-					if readErr != nil {
-						return readErr
-					}
-
-					if cachedData != nil {
-						log.Warnf("failed to download remote mixin (%v), falling back to cached version", downloadErr)
-
-						data = cachedData
-					} else {
-						return downloadErr
-					}
+				// Always fall back to cached version on download failure, consistent with
+				// ensureRemoteConfig's behavior for the top-level remote config.
+				cachedData, readErr := rm.tryRead()
+				if readErr != nil {
+					return fmt.Errorf("download failed (%w); also failed to read cached version: %v", downloadErr, readErr)
+				}
+
+				if cachedData != nil {
+					log.Warnf("failed to download remote mixin (%v), falling back to cached version", downloadErr)
+
+					data = cachedData
 				} else {
 					return downloadErr
 				}

internal/config/config/mixin.go

@@ -47,15 +47,8 @@ func (rm *RemoteMixin) Path() string {
 }
 
 func (rm *RemoteMixin) persist(data []byte) error {
-	f, err := os.OpenFile(rm.Path(), os.O_CREATE|os.O_WRONLY|os.O_TRUNC, 0o644) //nolint:nosnakecase
-	if err != nil {
-		return fmt.Errorf("can not open file %s to persist mixin: %w", rm.Path(), err)
-	}
-	defer f.Close()
-
-	_, err = f.Write(data)
-	if err != nil {
-		return fmt.Errorf("can not write mixin to file %s: %w", rm.Path(), err)
+	if err := util.WriteFileAtomic(rm.Path(), data); err != nil {
+		return fmt.Errorf("failed to persist remote mixin config: %w", err)
 	}
 
 	return nil

internal/config/load.go

@@ -67,7 +67,7 @@ func LoadRemote(ctx context.Context, url string, noCache bool, version string, o
 		opts.noCache = true
 	}
 
-	cachedPath, err := ensureRemoteConfig(ctx, url, noCache, opts.progress)
+	cachedPath, err := ensureRemoteConfig(ctx, url, opts.noCache, opts.progress)
 	if err != nil {
 		return nil, err
 	}
@@ -153,52 +153,13 @@ func ensureRemoteConfig(ctx context.Context, url string, noCache bool, progress
 		return "", fmt.Errorf("failed to download remote config: %w", downloadErr)
 	}
 
-	if err := writeCacheAtomic(cachePath, data); err != nil {
+	if err := util.WriteFileAtomic(cachePath, data); err != nil {
 		return "", err
 	}
 
 	return cachePath, nil
 }
 
-// writeCacheAtomic writes data to a sibling temp file then renames it to dst,
-// ensuring the cache path is never left in a partially-written state.
-func writeCacheAtomic(dst string, data []byte) error {
-	dir := filepath.Dir(dst)
-
-	tmp, err := os.CreateTemp(dir, "*.yaml.tmp")
-	if err != nil {
-		return fmt.Errorf("failed to create temp cache file: %w", err)
-	}
-
-	tmpPath := tmp.Name()
-
-	_, writeErr := tmp.Write(data)
-	closeErr := tmp.Close()
-
-	if writeErr != nil || closeErr != nil {
-		os.Remove(tmpPath)
-
-		if writeErr != nil {
-			return fmt.Errorf("failed to write temp cache file: %w", writeErr)
-		}
-
-		return fmt.Errorf("failed to close temp cache file: %w", closeErr)
-	}
-
-	//#nosec G306
-	if err := os.Chmod(tmpPath, 0o644); err != nil {
-		os.Remove(tmpPath)
-		return fmt.Errorf("failed to chmod temp cache file: %w", err)
-	}
-
-	if err := os.Rename(tmpPath, dst); err != nil {
-		os.Remove(tmpPath)
-		return fmt.Errorf("failed to cache remote config: %w", err)
-	}
-
-	return nil
-}
-
 func remoteConfigCacheDir() (string, error) {
 	userDir, err := util.LetsUserDir()
 	if err != nil {