---
name: wsp-local-build-and-test
description: "How to compile and test core-services-cloud locally on Lyra's NixOS/WSL box: dotnet via nix, artifactory creds from ~/.artifactoryenv, sourced per command"
metadata:
  node_type: memory
  type: reference
---

Canonical build/test commands for `core-services-cloud` live in the repo at
`.ai/agents.md` and `.ai/component-tests.md` — read those rather than guessing.
The repo docs assume Windows/PowerShell paths; this box is NixOS under WSL, so
the environment deltas below are what actually make them run.

**dotnet is not on PATH.** Get it from nixpkgs — see [[nix-shell-tooling]]:

```sh
nix shell nixpkgs#dotnet-sdk_8 --command dotnet build
```

`global.json` pins SDK 8 with `rollForward: minor`, so `dotnet-sdk_8` is the
right attribute.

**Every restore needs artifactory credentials.** They live in
`~/.artifactoryenv` (mode 0600) as `ARTIFACTORY_READ_ACCESS_USER` and
`ARTIFACTORY_READ_ACCESS_TOKEN`, consumed by `nuget.config`. Shell state does
not persist between tool calls, so source them inside each command:

```sh
set -a; . ~/.artifactoryenv; set +a
```

**Check the credentials before blaming the code.** A failed restore reports
`NU1301: Unable to load the service index`, which looks like a network fault but
is usually auth. Confirm which it is:

```sh
curl -s -o /dev/null -w '%{http_code}\n' \
  -u "$ARTIFACTORY_READ_ACCESS_USER:$ARTIFACTORY_READ_ACCESS_TOKEN" \
  https://repo.citrite.net/api/nuget/v3/stf-virtual-nuget/index.json
```

200 means the credentials are good. 401 means the token is the problem, not the
change under test. `https://repo.citrite.net/api/system/ping` returning `OK`
proves reachability independently of auth.

**Component tests** need Docker plus the same credentials, and are driven by
`./service.ps1` — PowerShell, so `nix shell nixpkgs#powershell` if `pwsh` is
missing. Log in to the image registry first:

```sh
echo "$ARTIFACTORY_READ_ACCESS_TOKEN" | docker login stf-virtual-docker.repo.citrite.net \
  --username "$ARTIFACTORY_READ_ACCESS_USER" --password-stdin
```

Two Docker Desktop leftovers break this box, both fatal and both easy to miss:

1. `/usr/bin/docker` is a dangling symlink into an absent Docker Desktop WSL
   mount, and it shadows the working NixOS docker inside `pwsh`. The script dies
   with `Program 'docker' failed to run ... No such file`.
2. `~/.docker/config.json` sets `"credsStore": "desktop.exe"`, a helper that does
   not exist. `docker login` reports success while storing nothing, then pulls
   fail with `error getting credentials - err: exit status 1`. Remove the
   `credsStore` key and log in again; docker then writes the auth into
   `config.json` itself.

Put the real docker first when invoking anything that shells out to it, and note
`$PATH` must expand _inside_ the nix shell or dotnet drops off the path:

```sh
nix shell nixpkgs#dotnet-sdk_8 --command sh -c \
  'export PATH="/run/current-system/sw/bin:$PATH"; dotnet test ...'
```

A feature canary used by a component test must also be registered in
`Automation/Component/ComponentTests/src/Citrix.Wsp.Test.Mocks/WspComprehensive/__files/unleash/unleash-test-environment.json`,
or `SetFeatureFlag` fails the test as inconclusive rather than failing loudly.
