test: read no contributor dotenv file during pytest (#1271)

Author: yyyyyyyan

pyproject.toml

@@ -320,7 +320,13 @@ markers = [
     "postgres: require a real PostgreSQL service (SEP_TEST_POSTGRES_DSN)",
     "mysql: require a real MySQL service (SEP_TEST_MYSQL_DSN)",
 ]
+# A developer dotenv file must never reach the suite: CI runs with no .env, so
+# any setting it carries makes the local run a weaker experiment than CI. This
+# pin points PreEnvSettings.ENV_FILE at a committed dotenv file with no
+# assignments, so pytest ignores contributor-local dotenv files (exported env
+# vars can still override as usual).
 env = [
+    "ENV_FILE=tests/pytest.env",
     "AUTH__PROVIDER__CASDOOR__CLIENT_ID=test-client-id",
     "AUTH__PROVIDER__CASDOOR__CLIENT_SECRET=test-client-secret",
     'AUTH__PROVIDER__CASDOOR__ALLOWED_ISSUERS=["https://allowed-issuer.com"]',

tests/app/sep/apps/alerts/test_api_routes.py

@@ -51,6 +51,9 @@
 
 API_BASE = "/api/apps/alerts"
 BEARER_HEADERS = {"Authorization": "Bearer test-token"}
+#: The parent of every logger the request path emits through. Naming it keeps the
+#: "no record carries the secret" assertions from passing on an empty capture.
+_APP_LOGGER = "app"
 
 
 _TEMPLATE_A = AlertTemplate(
@@ -331,7 +334,7 @@ def test_pagerduty_integration_key_with_control_chars_not_echoed(
             receiver="default", routes=[]
         )
         bad_key = "key\x00\nctrl"
-        with caplog.at_level("DEBUG"):
+        with caplog.at_level("DEBUG", logger=_APP_LOGGER):
             response = api_client.post(
                 f"{API_BASE}/pagerduty", json={"integration_key": bad_key}
             )
@@ -605,7 +608,7 @@ def test_does_not_log_integration_key(self, api_client, mock_pmm_api, caplog):
         mock_pmm_api.get_notification_policy.return_value = NotificationPolicy(
             receiver="default", routes=[]
         )
-        with caplog.at_level("DEBUG"):
+        with caplog.at_level("DEBUG", logger=_APP_LOGGER):
             response = api_client.post(
                 f"{API_BASE}/pagerduty",
                 json={"integration_key": "supersecretkey-xyz"},
@@ -719,7 +722,7 @@ def test_delete_does_not_log_integration_key(
         mock_pmm_api.get_notification_policy.return_value = NotificationPolicy(
             receiver="default", routes=[]
         )
-        with caplog.at_level("DEBUG"):
+        with caplog.at_level("DEBUG", logger=_APP_LOGGER):
             response = api_client.post(f"{API_BASE}/pagerduty/delete")
         assert response.status_code == status.HTTP_200_OK
         for record in caplog.records:

tests/app/sep/bundle_upload/test_plan.py

@@ -40,6 +40,7 @@
 _TICKET_URL = "http://localhost:8000/ticket_details"
 _ACCOUNT_URL = "http://localhost:8000/case_account"
 _MANIFEST: dict[str, Any] = {"bundle": "diag", "size": 12}
+_PLAN_LOGGER = "app.sep.bundle_upload.plan"
 
 
 @pytest.fixture(name="api")
@@ -695,7 +696,7 @@ async def test_non_json_upload_response_yields_an_empty_result(
                 body="accepted",
                 content_type="text/plain",
             )
-            with caplog.at_level("WARNING"):
+            with caplog.at_level("WARNING", logger=_PLAN_LOGGER):
                 async with api:
                     result = await executor.upload_bundle(
                         source_ref="src-9",
@@ -717,7 +718,7 @@ async def test_list_upload_response_yields_an_empty_result(
             mock.post(
                 _UPLOAD_URL, status=status.HTTP_201_CREATED, payload=[{"sys_id": "x"}]
             )
-            with caplog.at_level("WARNING"):
+            with caplog.at_level("WARNING", logger=_PLAN_LOGGER):
                 async with api:
                     result = await executor.upload_bundle(
                         source_ref="src-9",
@@ -739,7 +740,7 @@ async def test_unresolvable_reference_pointer_keeps_the_detail(
             mock.post(
                 _UPLOAD_URL, status=status.HTTP_201_CREATED, payload={"other": "x"}
             )
-            with caplog.at_level("WARNING"):
+            with caplog.at_level("WARNING", logger=_PLAN_LOGGER):
                 async with api:
                     result = await executor.upload_bundle(
                         source_ref="src-9",

tests/pytest.env

@@ -0,0 +1,4 @@
+# Contains no dotenv assignments. `[tool.pytest.ini_options] env` points ENV_FILE
+# here so a pytest run ignores any developer-local dotenv file, matching CI.
+# Settings the suite needs are pinned in that same `env` list; exported env vars
+# still override, and per-run values work via `VAR=x pytest ...`.