Add site-package to the end of inclusion path (#470)

Fixes: #469

Author: ssbarnea

src/ansible_compat/runtime.py

@@ -270,6 +270,7 @@ def _patch_collection_paths(self) -> None:
           ansible-core and ade behavior and trick ansible-galaxy to install
           default to the venv site-packages location (isolation).
         """
+        # ansible-core normal precedence is: adjacent, local paths, configured paths, site paths
         collections_paths: list[str] = self.config.collections_paths.copy()
         if self.config.collections_scan_sys_path:
             for path in sys.path:
@@ -280,15 +281,13 @@ def _patch_collection_paths(self) -> None:
                     collections_paths.append(  # pylint: disable=E1101
                         path,
                     )
-            # When inside a venv, we also add the site-packages to the top of the
-            # collections path because this is the first place where ansible-core
+            # When inside a venv, we also add the site-packages to the end of the
+            # collections path because this is the last place where ansible-core
             # will look for them. This also ensures that when calling ansible-galaxy
-            # to install content, it will be installed in the venv site-packages instead
-            # of altering the user configuration. Matches behavior of ADE and
-            # ensures isolation.
+            # to install content.
             for path in reversed(site.getsitepackages()):
                 if path not in collections_paths:
-                    collections_paths.insert(0, path)
+                    collections_paths.append(path)
 
             if collections_paths != self.config.collections_paths:
                 _logger.info(

test/test_runtime_scan_path.py

@@ -1,6 +1,8 @@
 """Test the scan path functionality of the runtime."""
 
 import json
+import os
+import subprocess
 import textwrap
 from pathlib import Path
 
@@ -93,3 +95,31 @@ def test_scan_sys_path(
         assert result["collection_path"] == str(installed_to)
 
     runtime_tmp.clean()
+
+
+def test_ro_venv() -> None:
+    """Tests behavior when the virtual environment is read-only.
+
+    See Related https://github.com/ansible/ansible-compat/pull/470
+    """
+    tox_work_dir = os.environ.get("TOX_WORK_DIR", ".tox")
+    venv_path = f"{tox_work_dir}/ro"
+    commands = [
+        f"mkdir -p {venv_path}",
+        f"chmod -R a+w {venv_path}",
+        f"python -m venv --symlinks {venv_path}",
+        f"{venv_path}/bin/python -m pip install -q -e .",
+        f"chmod -R a-w {venv_path}",
+        f"{venv_path}/bin/python -c \"from ansible_compat.runtime import Runtime; r = Runtime(); r.install_collection('ansible.posix:>=2.0.0')\"",
+    ]
+    for cmd in commands:
+        result = subprocess.run(  # noqa: S602
+            cmd,
+            check=False,
+            shell=True,
+            text=True,
+            capture_output=True,
+        )
+        assert (
+            result.returncode == 0
+        ), f"Got {result.returncode} running {cmd}\n\tstderr: {result.stderr}\n\tstdout: {result.stdout}"