From 69a7287d6996a549ec504fd73ea9aca32d00d6fa Mon Sep 17 00:00:00 2001
From: Antoine Toussaint
 <312536060+antoinetoussaint-byte@users.noreply.github.com>
Date: Tue, 22 Sep 2026 01:04:57 -0400
Subject: [PATCH] fix: own source-test fixture recovery scope

Source validation runs tests below the Go runner. Own fixture containers in that test process so the inherited CLI grandparent identity is never treated as valid ownership.
---
 main_test.go           |  1 +
 recovery_scope_test.go | 33 +++++++++++++++++++++++++++++++++
 2 files changed, 34 insertions(+)
 create mode 100644 recovery_scope_test.go

diff --git a/main_test.go b/main_test.go
index 09296b7..2420341 100644
--- a/main_test.go
+++ b/main_test.go
@@ -95,6 +95,7 @@ func TestCreateToRun(t *testing.T) {
 	})
 	require.NoError(t, err)
 	require.NotNil(t, init)
+	require.Equal(t, runtimev0.InitStatus_READY, init.Status.State, init.Status.Message)
 
 	defer func() {
 		_, err = runtime.Destroy(ctx, &runtimev0.DestroyRequest{})
diff --git a/recovery_scope_test.go b/recovery_scope_test.go
new file mode 100644
index 0000000..96a5b1d
--- /dev/null
+++ b/recovery_scope_test.go
@@ -0,0 +1,33 @@
+package main
+
+import (
+	"fmt"
+	"os"
+	"testing"
+
+	"github.com/codefly-dev/core/runners/dockerrun"
+)
+
+// The source-validation suite owns its fixture containers independently of
+// the CLI grandparent that launched the Go test process.
+func TestMain(m *testing.M) {
+	code := func() int {
+		dir, err := os.MkdirTemp("", "service-dynamodb-test-scope-*")
+		if err != nil {
+			fmt.Fprintln(os.Stderr, err)
+			return 1
+		}
+		defer os.RemoveAll(dir)
+		scope, err := dockerrun.NewContainerRecoveryScope(dir, dir, "service-dynamodb-tests")
+		if err != nil {
+			fmt.Fprintln(os.Stderr, err)
+			return 1
+		}
+		if err := dockerrun.SetContainerRecoveryScope(scope); err != nil {
+			fmt.Fprintln(os.Stderr, err)
+			return 1
+		}
+		return m.Run()
+	}()
+	os.Exit(code)
+}