fix(ci): host state fails four tests and one case #3585

Problem

The full gate uv run devops ci fails in the devcontainer on a clean worktree of origin/main. Four tests fail, and one contract case fails and errors. The same result comes from the branch fix/3497-cut-unchanged-github-reads, so the failure does not come from that branch.

Each failure depends on the state of the host:

• tests/crypto/test_ssh.py::test_get_ssh_key_prefix_resolution: the test expects the repository name my_plain_repo. It gets the name of the checkout directory, devops_cli.
• tests/telemetry/test_config_env_overrides.py::test_find_project_config_path_skips_directory: a file exists at /tmp/config.yaml on this host, so the path is not None.
• tests/commands/test_devcontainer_install_tools_dry_run.py::test_mark_only_commands_under_global_dry_run: the devcontainer tool is installed on this host, so its status is not not installed.
• tests/ai/test_tool_executor_contract.py::...[direct]: a tool under the user home directory is reached without a fake. The same case then errors at teardown, because a network edge was reached without a fake.

Expected

Each test passes on a host that has none of these files or tools. A test that depends on host state must use a fake or a path under tmp_path, as docs/TESTING.md requires. A test must not skip on host state.

Evidence

uv run devops ci test on the four test files gives 4 failed, 177 passed, 1 error on the branch and on origin/main.

Proposed design

Problem statement

The full gate uv run devops ci fails in the devcontainer on a clean worktree of origin/main. Four tests and one contract case read the state of the host: the checkout directory name, a file at /tmp/config.yaml, an installed devcontainer tool and an installed popeye. Each test must pass on every host through a fake or a path under tmp_path, and no test may skip on host state. The change fixes the four tests and the project config search that reaches the host's file.

Acceptance criteria

Requirement: SSH prefix fallback runs in its own directory

The SSH key-prefix test SHALL run the fallback case with the process working directory inside the directory under test.

Scenario: fallback prefix of a plain directory

• WHEN The test changes into /my_plain_repo and calls get_ssh_key_prefix on that directory.
• THEN The call returns my_plain_repo on a host whose checkout directory is devops_cli.

Requirement: Project config search stops at a project root

The project config search SHALL accept a config file in an ancestor directory only when that ancestor holds a .git or a .devcontainer entry.

Scenario: config file in an ancestor with no project marker

• WHEN A config.yaml sits in the parent of the base directory, and that parent holds no .git and no .devcontainer.
• THEN _find_project_config_path returns None.

Requirement: Install-tools status names no tool of the host

The mark-only dry-run test SHALL run install-tools status with a PATH that names no installed tool.

Scenario: status with an empty PATH

• WHEN The test sets PATH to an empty directory under tmp_path and runs devops --dry-run install-tools status.
• THEN The command exits 0 and its output holds not installed.

Requirement: Network-profile case starts no tool of the host

The direct-executor network-profile case SHALL resolve its tool from a stand-in under tmp_path.

Scenario: kube-api request with a stand-in tool

• WHEN The case puts a popeye stand-in first on PATH under tmp_path, and runs the request with the kube-api network profile.
• THEN The run raises SandboxError that names kube-api, and the stand-in writes no marker file.

Requirement: The four modules pass on a host with the interfering state

The four test modules SHALL pass and skip no test on a host that holds /tmp/config.yaml and the installed tools.

Scenario: the four modules on the host that failed

• WHEN uv run devops ci test runs the four modules on the devcontainer host.
• THEN The run reports no failure and no error, and no test is skipped.

Existing Tool Considered

No alternatives check has run. No open, maintained tool or library covers this need: the change edits four test modules and one config search of this repository. It builds no code to keep, so the cost is the edit alone: about 25,000 tokens and under one hour of elapsed time, with no code that later needs fixes.

Key questions

• Which case of the SSH test depends on the checkout directory name, and how does it become hermetic?: The fallback case does. With no .devcontainer in the directory, get_ssh_key_prefix names the key after the process working directory, which is the checkout. The test changes into /my_plain_repo before the assertion, as its other cases already change into their own directories. (best practice) [sources: tests/crypto/test_ssh.py, src/devops_cli/crypto/ssh_keys.py, docs/TESTING.md]
  • Chosen: change into the directory under test. The case with an unparseable .devcontainer already pins the directory-name fallback, and the test comment names the base name of the process working directory.
  • Rejected: change get_ssh_key_prefix to use the given directory. It changes the fallback that the case with an unparseable .devcontainer pins, and the issue is a test fix.
  • Rejected: skip the case when the name differs. docs/TESTING.md forbids a skip on host state.
• Why does the project config search reach /tmp/config.yaml, and what bound stops it?: The search walks up from the base directory to the filesystem root and accepts any config.yaml. It stops at an ancestor that holds no project marker: the base directory itself, or an ancestor with .git or .devcontainer, gives a config. (best practice) [sources: tests/telemetry/test_config_env_overrides.py, tests/crypto/test_ssh.py, src/devops_cli/config/settings.py, docs/TESTING.md]
  • Chosen: accept an ancestor config only at a project marker. It keeps the ancestor lookup that the .devcontainer/config.yaml case needs, and it ignores a stray file in the system temporary directory.
  • Rejected: stop the walk at the system temporary directory. It hard-codes a host path, while a project marker is a property of the project.
  • Rejected: set HOME to tmp_path in the test. The run's home is no ancestor of tmp_path, so the walk still reaches the temporary directory.
• How does the install-tools status case keep the host's installed tools out?: It sets PATH to an empty directory under tmp_path, so the lookup of each tool finds no tool and the status says not installed. (best practice) [sources: tests/commands/test_devcontainer_install_tools_dry_run.py, src/devops_cli/commands/install_tools.py, docs/TESTING.md]
  • Chosen: set PATH to an empty directory under tmp_path. It is the test's own environment, and a dry run starts no program.
  • Rejected: patch shutil.which. Patching a stdlib object is the fallback for an edge with no seam, and PATH reaches the lookup already.
  • Rejected: accept either status text. It removes the contract that the test checks.
• Which direct-executor case reaches a tool under the user home directory and a network edge?: The network-profile case does. It names the tool popeye and no stand-in, so the direct executor resolves the host's copy, which then reaches the Kubernetes API. [sources: tests/ai/test_tool_executor_contract.py]
• How does the network-profile case keep the host's tool out?: It puts a popeye stand-in first on PATH under tmp_path, as the scenario fixture puts the helm stand-in, and it asserts that the stand-in wrote no marker. The refusal then names kube-api on every host. (best practice) [sources: tests/ai/test_tool_executor_contract.py, docs/TESTING.md]
  • Chosen: put a stand-in for the tool first on PATH. The scenario fixture already does this for helm, and the case then resolves no tool of the host.
  • Rejected: expect the missing-tool error. The case must hold the refusal of the network profile, which is the behaviour under test.
  • Rejected: mark the case bwrap. The direct executor runs without the sandbox, and the mark hides the case from the default run.
• May a test skip when the host has the interfering state?: No. A test must not skip on host state: a case that cannot run the same on every host is a contract case or a row of devops ci. (best practice) [sources: docs/TESTING.md, docs/adr/0007-tests-double-only-process-edges.md]
  • Chosen: no skip on host state. docs/TESTING.md states it, and a skip hides the defect from the gate.
  • Rejected: skip when the state is present. It leaves the four modules untested on the host that failed.

Fit

Fits in one pull request.

Suspected block

None.

Dependencies

None.