Fix remaining CI failures

Three issues:

1. Changelog tests used FileSystem.Path.GetTempPath() to generate unique
   paths within MockFileSystem. Since MockFS is in-memory, the paths can be
   anything in scope — replace with Paths.WorkingDirectoryRoot.FullName as
   the base so they stay within the ScopedFileSystem scope bounds. No real
   filesystem is touched; all operations remain in-memory.

2. DocsSyncTests.TestApply passed the same WrapToRead FS for both read and
   write in AssembleContext. AwsS3SyncApplyStrategy uses context.WriteFileSystem
   and needs AllowedSpecialFolders.Temp (present in WriteOptions). Fix by
   using WrapToWrite for the write FS.

3. IsolatedBuildService CI fallback defaulted the output path to
   Paths.WorkingDirectoryRoot/.artifacts/docs/html. When --path points to a
   different repo the write FS is scoped to that repo's root, not
   WorkingDirectoryRoot. Derive the default output from `path` instead so it
   stays within the write FS scope (same logic as BuildContext uses for the
   normal build path).

   FileSystemFactory.RealForPathWrite: replace StartsWith string check with
   IDirectoryInfo.IsSubPathOf from Nullean.ScopedFileSystem which does a
   proper directory-tree walk, preventing sibling-prefix false positives.

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

Author: Mpdreamz

src/Elastic.Documentation.Configuration/FileSystemFactory.cs

@@ -133,7 +133,8 @@ public static ScopedFileSystem RealForPathWrite(string? path, string? output = n
 		if (output is not null)
 		{
 			var absOutput = Path.IsPathRooted(output) ? output : Path.GetFullPath(output);
-			if (!absOutput.StartsWith(gitRoot, StringComparison.OrdinalIgnoreCase))
+			var plain = new FileSystem();
+			if (!plain.DirectoryInfo.New(absOutput).IsSubPathOf(plain.DirectoryInfo.New(gitRoot)))
 				roots.Add(absOutput);
 		}
 

src/services/Elastic.Documentation.Isolated/IsolatedBuildService.cs

@@ -100,11 +100,15 @@ public async Task<bool> Build(
 		// At some point in the future we can remove this try catch
 		catch (Exception e) when (runningOnCi && e.Message.StartsWith("Can not locate docset.yml file in", OrdinalIgnoreCase))
 		{
+			// Derive the default output from `path` so it stays within the write FS scope.
+			// Using Paths.WorkingDirectoryRoot would be wrong when --path points to a different repo.
+			var rootFolder = !string.IsNullOrWhiteSpace(path) ? path : Paths.WorkingDirectoryRoot.FullName;
+			var writeFs = writeFileSystem ?? fileSystem;
 			var outputDirectory = !string.IsNullOrWhiteSpace(output)
-				? fileSystem.DirectoryInfo.New(output)
-				: fileSystem.DirectoryInfo.New(Path.Join(Paths.WorkingDirectoryRoot.FullName, ".artifacts/docs/html"));
+				? writeFs.DirectoryInfo.New(output)
+				: writeFs.DirectoryInfo.New(Path.Join(rootFolder, ".artifacts/docs/html"));
 			// we temporarily do not error when pointed to a non-documentation folder.
-			_ = fileSystem.Directory.CreateDirectory(outputDirectory.FullName);
+			_ = writeFs.Directory.CreateDirectory(outputDirectory.FullName);
 
 			_logger.LogInformation("Skipping build as we are running on a merge commit and the docs folder is out of date and has no docset.yml. {Message}",
 				e.Message);

tests-integration/Elastic.Assembler.IntegrationTests/DocsSyncTests.cs

@@ -46,7 +46,8 @@ public async Task TestPlan()
 		var configurationContext = TestHelpers.CreateConfigurationContext(fileSystem);
 		var config = AssemblyConfiguration.Create(configurationContext.ConfigurationFileProvider);
 		var scopedFs = FileSystemFactory.WrapToRead(fileSystem);
-		var context = new AssembleContext(config, configurationContext, "dev", collector, scopedFs, scopedFs, null, Path.Join(Paths.WorkingDirectoryRoot.FullName, ".artifacts", "assembly"));
+		var scopedWriteFs = FileSystemFactory.WrapToWrite(fileSystem);
+		var context = new AssembleContext(config, configurationContext, "dev", collector, scopedFs, scopedWriteFs, null, Path.Join(Paths.WorkingDirectoryRoot.FullName, ".artifacts", "assembly"));
 		A.CallTo(() => mockS3Client.ListObjectsV2Async(A<ListObjectsV2Request>._, A<Cancel>._))
 			.Returns(new ListObjectsV2Response
 			{
@@ -188,7 +189,8 @@ bool valid
 		var configurationContext = TestHelpers.CreateConfigurationContext(fileSystem);
 		var config = AssemblyConfiguration.Create(configurationContext.ConfigurationFileProvider);
 		var scopedFs2 = FileSystemFactory.WrapToRead(fileSystem);
-		var context = new AssembleContext(config, configurationContext, "dev", collector, scopedFs2, scopedFs2, null, Path.Join(Paths.WorkingDirectoryRoot.FullName, ".artifacts", "assembly"));
+		var scopedWriteFs2 = FileSystemFactory.WrapToWrite(fileSystem);
+		var context = new AssembleContext(config, configurationContext, "dev", collector, scopedFs2, scopedWriteFs2, null, Path.Join(Paths.WorkingDirectoryRoot.FullName, ".artifacts", "assembly"));
 
 		var s3Objects = new List<S3Object>();
 		foreach (var i in Enumerable.Range(0, remoteFiles))
@@ -239,7 +241,8 @@ public async Task TestApply()
 		var config = AssemblyConfiguration.Create(configurationContext.ConfigurationFileProvider);
 		var checkoutDirectory = Path.Join(Paths.WorkingDirectoryRoot.FullName, ".artifacts", "assembly");
 		var scopedFs3 = FileSystemFactory.WrapToRead(fileSystem);
-		var context = new AssembleContext(config, configurationContext, "dev", collector, scopedFs3, scopedFs3, null, checkoutDirectory);
+		var scopedWriteFs3 = FileSystemFactory.WrapToWrite(fileSystem);
+		var context = new AssembleContext(config, configurationContext, "dev", collector, scopedFs3, scopedWriteFs3, null, checkoutDirectory);
 		var plan = new SyncPlan
 		{
 			RemoteListingCompleted = true,

tests/Elastic.Changelog.Tests/Changelogs/BundleAmendTests.cs

@@ -4,6 +4,7 @@
 
 using AwesomeAssertions;
 using Elastic.Changelog.Bundling;
+using Elastic.Documentation.Configuration;
 using Elastic.Documentation.Configuration.ReleaseNotes;
 
 namespace Elastic.Changelog.Tests.Changelogs;
@@ -23,7 +24,7 @@ public BundleAmendTests(ITestOutputHelper output) : base(output)
 
 	private string CreateChangelogDir()
 	{
-		var changelogDir = FileSystem.Path.Join(FileSystem.Path.GetTempPath(), Guid.NewGuid().ToString());
+		var changelogDir = FileSystem.Path.Join(Paths.WorkingDirectoryRoot.FullName, Guid.NewGuid().ToString());
 		FileSystem.Directory.CreateDirectory(changelogDir);
 		return changelogDir;
 	}
@@ -48,7 +49,7 @@ private async Task<string> CreateResolvedBundle(CancellationToken ct)
 		var changelogFile = FileSystem.Path.Join(_changelogDir, "1755268130-existing.yaml");
 		await FileSystem.File.WriteAllTextAsync(changelogFile, changelog, ct);
 
-		var bundlePath = FileSystem.Path.Join(FileSystem.Path.GetTempPath(), Guid.NewGuid().ToString(), "bundle.yaml");
+		var bundlePath = FileSystem.Path.Join(Paths.WorkingDirectoryRoot.FullName, Guid.NewGuid().ToString(), "bundle.yaml");
 		var input = new BundleChangelogsArguments
 		{
 			Directory = _changelogDir,
@@ -87,7 +88,7 @@ private async Task<string> CreateUnresolvedBundle(CancellationToken ct)
 		var changelogFile = FileSystem.Path.Join(_changelogDir, "1755268130-existing.yaml");
 		await FileSystem.File.WriteAllTextAsync(changelogFile, changelog, ct);
 
-		var bundlePath = FileSystem.Path.Join(FileSystem.Path.GetTempPath(), Guid.NewGuid().ToString(), "bundle.yaml");
+		var bundlePath = FileSystem.Path.Join(Paths.WorkingDirectoryRoot.FullName, Guid.NewGuid().ToString(), "bundle.yaml");
 		var input = new BundleChangelogsArguments
 		{
 			Directory = _changelogDir,
@@ -112,7 +113,7 @@ private async Task<string> CreateUnresolvedBundle(CancellationToken ct)
 	/// </summary>
 	private async Task<string> CreateNewChangelogFile(CancellationToken ct)
 	{
-		var newDir = FileSystem.Path.Join(FileSystem.Path.GetTempPath(), Guid.NewGuid().ToString());
+		var newDir = FileSystem.Path.Join(Paths.WorkingDirectoryRoot.FullName, Guid.NewGuid().ToString());
 		FileSystem.Directory.CreateDirectory(newDir);
 
 		// language=yaml