fix: use pthread_once for thread-safe getenv initialization

[Copilot]

Fixes data race in init_real_getenv() where multiple threads could observe real_getenv == NULL and call dlsym() concurrently, writing to the function pointer simultaneously.

Changes:

• Replace manual null check with pthread_once() for guaranteed single initialization
• Split into init_real_getenv_once() (initialization logic) and init_real_getenv() (pthread_once wrapper)
• Update error message from "ERROR" to "FATAL" and fix comment to reflect actual abort behavior

Before:

static void init_real_getenv(void) {
    if (real_getenv == NULL) {  // ← Race: multiple threads can enter
        real_getenv = dlsym(RTLD_NEXT, "getenv");
        // ...
    }
}

After:

static pthread_once_t getenv_init_once = PTHREAD_ONCE_INIT;

static void init_real_getenv_once(void) {
    real_getenv = dlsym(RTLD_NEXT, "getenv");
    // ...
}

static void init_real_getenv(void) {
    pthread_once(&getenv_init_once, init_real_getenv_once);
}

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[Copilot]

Pull request overview

This PR fixes a data race in init_real_getenv() by switching to pthread_once() for one-time, thread-safe initialization of the dlsym()-resolved getenv function pointer.

Changes:

• Replace manual real_getenv == NULL check with pthread_once() to guarantee single initialization.
• Split initialization into init_real_getenv_once() (does dlsym) and init_real_getenv() (wrapper).
• Update failure messaging/comment and add a CodeQL source root marker file.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
containers/agent/one-shot-token/one-shot-token.c	Uses pthread_once() to make real_getenv initialization thread-safe and adjusts fatal error handling.
_codeql_detected_source_root	Adds a CodeQL-detected source root marker.

Comments suppressed due to low confidence (1)

_codeql_detected_source_root:1

• This looks like an auto-generated CodeQL marker file. If it’s generated by tooling during analysis, it typically shouldn’t be committed; consider removing it and adding it to .gitignore (or documenting why it must be tracked if your pipeline relies on it being present in-repo).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

dlsym() errors should be checked via dlerror(), not by comparing the returned pointer to NULL. Per dlsym() semantics, NULL can be a valid symbol value, and dlerror() may also return a stale error unless you clear it before calling dlsym(). Clear dlerror() first, call dlsym(), then call dlerror() and abort only if it reports an error.

See below for a potential fix:

    const char *err;

    /* Clear any existing error */
    (void)dlerror();

    real_getenv = dlsym(RTLD_NEXT, "getenv");
    err = dlerror();
    if (err != NULL) {
        fprintf(stderr, "[one-shot-token] FATAL: Could not find real getenv: %s\n", err);

[Copilot]

Assigning the void * result of dlsym() directly to a function pointer is not portable ISO C and can trigger warnings (even if it works on many POSIX platforms). Prefer assigning via an intermediate void * and memcpy, or the common POSIX pattern *(void **)(&real_getenv) = dlsym(...); to avoid undefined-behavior concerns and compiler diagnostics.

See below for a potential fix:

    void *sym = dlsym(RTLD_NEXT, "getenv");
    if (sym == NULL) {
        fprintf(stderr, "[one-shot-token] FATAL: Could not find real getenv: %s\n", dlerror());
        /* Cannot recover - abort to prevent undefined behavior */
        abort();
    }
    memcpy(&real_getenv, &sym, sizeof(real_getenv));