fix(supervisor): stop the runner token's uid reaching the Runner spec

Mono-RevId: b882af2b96296eb4b1010903fe41af0b2b612572

Author: 1stvamp

apps/supervisor/src/workloadManager/runCrd.test.ts

@@ -53,6 +53,33 @@ describe("runnerBodyFor carries the isolation lane it is given", () => {
   });
 });
 
+/**
+ * Asserted here because the type cannot: create() passes a variable, and
+ * TypeScript's excess property check only applies to object literals.
+ */
+describe("runnerBodyFor sends only what the CRD declares", () => {
+  it("takes only name and key from a wider token handle", () => {
+    const body = runnerBodyFor(createOptions(), {
+      ...meta,
+      token: { name: "runner-abc123-token-deadbeef", key: "token", uid: "uid-not-in-the-crd" } as {
+        name: string;
+        key: string;
+      },
+    });
+
+    expect(body.spec.deployment.token).toEqual({
+      name: "runner-abc123-token-deadbeef",
+      key: "token",
+    });
+  });
+
+  it("omits the token entirely when there is none", () => {
+    const body = runnerBodyFor(createOptions(), meta);
+
+    expect(body.spec.deployment).not.toHaveProperty("token");
+  });
+});
+
 describe("runnerBodyFor", () => {
   it("names the object after the runner and carries the required spec", () => {
     const body = runnerBodyFor(createOptions(), meta);

apps/supervisor/src/workloadManager/runCrd.ts

@@ -296,7 +296,9 @@ export function runnerBodyFor(
       deployment: {
         friendlyID: opts.deploymentFriendlyId,
         version: opts.deploymentVersion,
-        ...(meta.token ? { token: meta.token } : {}),
+        // Field by field, not spread: the handle also carries the Secret's uid,
+        // which the spec has no field for and Strict validation rejects by name.
+        ...(meta.token ? { token: { name: meta.token.name, key: meta.token.key } } : {}),
       },
       owner: {
         envID: opts.envId,