test_quality_gate_sandbox.py

Go to the documentation of this file.

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
# tests/tests_git/test_quality_gate_sandbox.py
 
"""
Purpose
-------
OI-517 regression coverage — ``oct git check --sandbox`` must route the
optional pytest subprocess through :class:`oct.mcp.sandbox.SandboxExecutor`
so the sanitised environment rules (``PYTHONPATH`` stripped, secret-named
env vars stripped, output capped, 600s timeout) apply whenever tests are
included in the quality gate.
 
When ``--sandbox`` is absent, pytest must still run via the legacy
``subprocess.run`` path (unchanged behaviour for existing CI).
 
Responsibilities
----------------
- Verify ``sandbox=True`` routes pytest through ``SandboxExecutor``.
- Verify ``sandbox=False`` uses ``subprocess.run`` directly.
- Verify ``--sandbox`` CLI option threads through to ``run_quality_gate``.
 
Diagnostics
-----------
Domain: GIT-TESTS
Levels:
    L2 — test lifecycle
    L3 — assertion details
    L4 — deep tracing
 
Contracts
---------
- ``_run_test_pass(project_root, sandbox=True)`` goes through
  :class:`SandboxExecutor`.
- ``_run_test_pass(project_root)`` / ``sandbox=False`` uses
  ``subprocess.run`` directly.
- The CLI option ``--sandbox`` on ``oct git check`` threads through to
  :func:`run_quality_gate`.
"""
 
from __future__ import annotations
 
from dataclasses import dataclass
from pathlib import Path
 
import pytest
from click.testing import CliRunner
 
from oct.cli import cli
from oct.git import quality_gate as qg
 
 
@dataclass
class _FakeCompleted:
    returncode: int = 0
    stdout: str = ""
    stderr: str = ""
 
 
def test_run_test_pass_default_uses_subprocess(tmp_path: Path, monkeypatch):
    """OI-517: no sandbox flag → legacy subprocess.run path."""
    calls = {"subprocess": 0, "sandbox": 0}
 
    def _fake_subprocess_run(*args, **kwargs):
        calls["subprocess"] += 1
        return _FakeCompleted(returncode=0)
 
    class _FakeExecutor:
        def __init__(self, *a, **kw):
            calls["sandbox"] += 1
 
        def run(self, cmd, cwd, timeout):  # noqa: ARG002
            return _FakeCompleted(returncode=0)
 
    monkeypatch.setattr(qg.subprocess, "run", _fake_subprocess_run)
    monkeypatch.setattr("oct.mcp.sandbox.SandboxExecutor", _FakeExecutor)
 
    qg._run_test_pass(tmp_path, sandbox=False)
    assert calls["subprocess"] == 1
    assert calls["sandbox"] == 0
 
 
def test_run_test_pass_sandbox_uses_executor(tmp_path: Path, monkeypatch):
    """OI-517: sandbox=True → SandboxExecutor.run replaces subprocess.run."""
    calls = {"subprocess": 0, "sandbox_run": 0}
 
    def _fake_subprocess_run(*args, **kwargs):
        calls["subprocess"] += 1
        return _FakeCompleted(returncode=0)
 
    captured = {}
 
    class _FakeSandboxResult:
        def __init__(self, code):
            self.exit_code = code
            self.timed_out = False
 
    class _FakeExecutor:
        def __init__(self, *a, **kw):
            pass
 
        def run(self, cmd, cwd, timeout):
            calls["sandbox_run"] += 1
            captured["cmd"] = cmd
            captured["cwd"] = cwd
            captured["timeout"] = timeout
            return _FakeSandboxResult(0)
 
    monkeypatch.setattr(qg.subprocess, "run", _fake_subprocess_run)
    monkeypatch.setattr("oct.mcp.sandbox.SandboxExecutor", _FakeExecutor)
 
    qg._run_test_pass(tmp_path, sandbox=True)
    assert calls["sandbox_run"] == 1
    assert calls["subprocess"] == 0
    assert captured["timeout"] == 600
    assert "pytest" in captured["cmd"]
 
 
def test_cli_check_accepts_sandbox_flag():
    """OI-517: ``oct git check --sandbox --help`` parses; flag documented."""
    runner = CliRunner()
    result = runner.invoke(cli, ["git", "check", "--help"])
    assert result.exit_code == 0
    assert "--sandbox" in result.output
    assert "MCP sandbox" in result.output