ci: apply the pytest per-test timeout and stop the SSE role test from blocking

Wire the already-defined per-test timeout into the default pytest arguments so a
stuck test fails fast instead of running to the job limit, and pass timeout=1 to
the streaming request endpoint in the role-enforcement test so its assertion (the
role gate does not reject a viewer) runs without waiting out the stream's default
300s duration.

Author: fgogolli

makefiles/common.mk

@@ -52,10 +52,18 @@ COVERAGE_REPORT := coverage.xml
 COVERAGE_HTML := htmlcov
 
 # Test settings
-PYTEST_ARGS := -v --tb=short --durations=10
-PYTEST_COV_ARGS := --cov=$(PACKAGE_ROOT) --cov-report=term-missing --cov-branch
-PYTEST_TIMEOUT := --timeout=300
+PYTEST_TIMEOUT := --timeout=$(shell yq '.ci.test_timeout' $(PROJECT_CONFIG) 2>/dev/null || echo "300")
 PYTEST_MAXFAIL := --maxfail=5
+PYTEST_ARGS := -v --tb=short --durations=25 $(PYTEST_TIMEOUT)
+COVERAGE_THRESHOLD := $(shell yq '.ci.coverage_threshold' $(PROJECT_CONFIG) 2>/dev/null || echo "70")
+PYTEST_COV_ARGS := --cov=$(PACKAGE_ROOT) --cov-report=term-missing --cov-branch
+# --cov-fail-under is intentionally absent from PYTEST_COV_ARGS.  Individual CI
+# test legs (unit-only, integration-only, infrastructure-only, providers-only) each
+# cover a fraction of the package; enforcing the threshold per-leg would fail every
+# leg that doesn't happen to exercise the other layers.  The combined threshold is
+# enforced by the ci-tests-coverage-check target which first runs `coverage combine`
+# to merge all per-leg .coverage files before applying --fail-under.
+PYTEST_COV_FAIL_UNDER := --cov-fail-under=$(COVERAGE_THRESHOLD)
 
 # Documentation settings
 DOCS_DIR := docs

tests/unit/api/test_role_enforcement.py

@@ -472,7 +472,11 @@ def _app_with_no_rank_user(router) -> FastAPI:
     (requests_router, "GET", "/requests/return", None),
     (requests_router, "GET", "/requests/req-1/status", None),
     (requests_router, "POST", "/requests/status", {"request_ids": ["req-1"]}),
-    (requests_router, "GET", "/requests/req-1/stream", None),
+    # ?timeout=1 keeps the SSE stream from blocking on its 300s default: this
+    # test only asserts the role gate does not 403, which fires before the
+    # stream generator runs.  Without the override the generator loops until
+    # pytest-timeout kills it at 300s, dominating the whole unit leg.
+    (requests_router, "GET", "/requests/req-1/stream?timeout=1", None),
     # machines router
     (machines_router, "GET", "/machines/", None),
     (machines_router, "GET", "/machines/m-1/status", None),