Skip to content

CI: hermetic spawns in scan/vendor tests (#823) #1448

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Mikola Lysenko (mikolalysenko) merged 3 commits into from
Oct 12, 2026
Merged

CI: hermetic spawns in scan/vendor tests (#823) #1448

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
8644587
Start hermetic spawn slice 5 for #823
claude Oct 12, 2026
c918546
Spawn scan/vendor test children hermetically
claude Oct 12, 2026
9330762
Describe the hermetic env in eject test docs
claude Oct 12, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 5 additions & 9 deletions crates/socket-patch-cli/tests/scan_api_retry_e2e.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,9 @@
//! retries without sleeping (the backoff arithmetic itself is pinned on a
//! virtual clock in the core crate's `api_retry_e2e.rs`).

#[path = "common/hermetic.rs"]
mod hermetic;

use std::path::Path;
use std::process::Command;

Expand Down Expand Up @@ -43,15 +46,8 @@ fn encode_purl(purl: &str) -> String {
}

fn scrubbed_cli() -> Command {
let mut cmd = Command::new(env!("CARGO_BIN_EXE_socket-patch"));
for (key, _) in std::env::vars_os() {
let name = key.to_string_lossy();
if name.starts_with("SOCKET_") && name != "SOCKET_NO_CONFIG" {
cmd.env_remove(&key);
}
}
cmd.env_remove("VIRTUAL_ENV");
cmd.env("SOCKET_TELEMETRY_DISABLED", "1");
let mut cmd = hermetic::binary_command();
hermetic::scrub_extra(&mut cmd, &[hermetic::Extra::Venv]);
cmd
}

Expand Down
15 changes: 3 additions & 12 deletions crates/socket-patch-cli/tests/scan_pnpm_relocated_store_cwd_e2e.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,10 +11,9 @@

#[path = "common/mod.rs"]
mod common;
use common::binary;
use common::{binary, hermetic, hermetic_command};

use std::path::{Path, PathBuf};
use std::process::Command;

use wiremock::matchers::{method, path};
use wiremock::{Mock, MockServer, ResponseTemplate};
Expand Down Expand Up @@ -68,18 +67,10 @@ async fn scan_bodies(cwd: &Path) -> String {
})))
.mount(&server)
.await;
let mut cmd = Command::new(binary());
let mut cmd = hermetic_command(&binary());
hermetic::scrub_extra(&mut cmd, &[hermetic::Extra::Venv]);
cmd.arg("scan").current_dir(cwd);
for (key, _) in std::env::vars_os() {
if key.to_string_lossy().starts_with("SOCKET_")
&& key.to_string_lossy() != "SOCKET_NO_CONFIG"
{
cmd.env_remove(&key);
}
}
cmd.env_remove("VIRTUAL_ENV");
cmd.env("CARGO_HOME", cwd.join(".cargo-home"));
cmd.env("SOCKET_TELEMETRY_DISABLED", "1");
let out = cmd
.args([
"--json",
Expand Down
7 changes: 4 additions & 3 deletions crates/socket-patch-cli/tests/scan_requirements_lock_only.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,8 +26,10 @@
//! vendored mode. The package names are fixtures no interpreter on the
//! machine has installed, so every hit is a lock-only one.

#[path = "common/hermetic.rs"]
mod hermetic;

use std::path::Path;
use std::process::Command;

use wiremock::matchers::{method, path};
use wiremock::{Mock, MockServer, ResponseTemplate};
Expand Down Expand Up @@ -63,10 +65,9 @@ fn run_scan(
ORG_SLUG,
];
argv.extend_from_slice(extra);
let out = Command::new(env!("CARGO_BIN_EXE_socket-patch"))
let out = hermetic::binary_command()
.args(&argv)
.current_dir(root)
.env("SOCKET_TELEMETRY_DISABLED", "1")
.env_remove("VIRTUAL_ENV")
.env_remove("CONDA_PREFIX")
.envs(envs.iter().copied())
Expand Down
32 changes: 6 additions & 26 deletions crates/socket-patch-cli/tests/scan_rollout_e2e.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,13 +5,12 @@

#[path = "common/mod.rs"]
mod common;
use common::{binary, git_sha256};
use common::{binary, git_sha256, hermetic_command};

#[path = "prebuilt_common/mod.rs"]
mod prebuilt_common;

use std::path::Path;
use std::process::Command;

use serde_json::{json, Value};
use wiremock::matchers::{method, path, path_regex};
Expand Down Expand Up @@ -273,14 +272,8 @@ fn run(root: &Path, mock: &MockServer, args: &[&str]) -> (i32, String, String) {
ORG,
];
argv.extend_from_slice(args);
let mut cmd = Command::new(binary());
let mut cmd = hermetic_command(&binary());
cmd.args(&argv).current_dir(root);
for (key, _) in std::env::vars_os() {
if key.to_string_lossy().starts_with("SOCKET_") {
cmd.env_remove(&key);
}
}
cmd.env("SOCKET_TELEMETRY_DISABLED", "1");
let out = cmd.output().expect("run socket-patch");
(
out.status.code().unwrap_or(-1),
Expand Down Expand Up @@ -797,18 +790,12 @@ async fn a_malformed_env_cap_is_a_usage_error_unless_the_flag_overrides_it() {
mount_api(&mock, |_| Grant::Granted).await;
let tmp = tempfile::tempdir().unwrap();
write_project(tmp.path(), &["roll-a", "roll-b"]);
let mut cmd = Command::new(binary());
let mut cmd = hermetic_command(&binary());
cmd.args(["scan", "--json", "--api-url"])
.arg(mock.uri())
.args(["--api-token", "t", "--org", ORG])
.current_dir(tmp.path());
for (key, _) in std::env::vars_os() {
if key.to_string_lossy().starts_with("SOCKET_") {
cmd.env_remove(&key);
}
}
cmd.env("SOCKET_TELEMETRY_DISABLED", "1")
.env("SOCKET_MAX_NEW_PATCHES", "lots");
cmd.env("SOCKET_MAX_NEW_PATCHES", "lots");
let out = cmd.output().unwrap();
assert_eq!(out.status.code(), Some(2));
// Under --json the coded usage error goes to stdout (#704).
Expand All @@ -822,7 +809,7 @@ async fn a_malformed_env_cap_is_a_usage_error_unless_the_flag_overrides_it() {
);

// A flag overrides the env value without reading it.
let mut with_flag = Command::new(binary());
let mut with_flag = hermetic_command(&binary());
with_flag
.args([
"scan",
Expand All @@ -835,14 +822,7 @@ async fn a_malformed_env_cap_is_a_usage_error_unless_the_flag_overrides_it() {
.arg(mock.uri())
.args(["--api-token", "t", "--org", ORG])
.current_dir(tmp.path());
for (key, _) in std::env::vars_os() {
if key.to_string_lossy().starts_with("SOCKET_") {
with_flag.env_remove(&key);
}
}
with_flag
.env("SOCKET_TELEMETRY_DISABLED", "1")
.env("SOCKET_MAX_NEW_PATCHES", "lots");
with_flag.env("SOCKET_MAX_NEW_PATCHES", "lots");
let out = with_flag.output().unwrap();
assert_eq!(
out.status.code(),
Expand Down
56 changes: 17 additions & 39 deletions crates/socket-patch-cli/tests/scan_vendor_e2e.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,6 @@
mod prebuilt_common;

use std::path::{Path, PathBuf};
use std::process::Command;

use sha2::Digest;
use wiremock::matchers::{method, path};
Expand Down Expand Up @@ -55,7 +54,7 @@ mod vex_e2e_common;

#[path = "common/mod.rs"]
mod common;
use common::{binary, git_sha256};
use common::{binary, git_sha256, hermetic_command};

const ORG_SLUG: &str = "test-org";
const UUID: &str = "11111111-1111-4111-8111-111111111111";
Expand Down Expand Up @@ -184,25 +183,17 @@ async fn mount_patch_api(mock: &MockServer, uuid: &str) {
/// Spawn the built binary in `root` with `extra_env` injected into the
/// child environment.
fn run_cli_env(root: &Path, argv: &[&str], extra_env: &[(&str, &str)]) -> (i32, String, String) {
let mut cmd = Command::new(binary());
let mut cmd = hermetic_command(&binary());
cmd.args(argv).current_dir(root);
// Scrub the ambient `SOCKET_*` surface (prefix scrub — fixed lists rot)
// so a developer's shell can't steer the child, then force the telemetry
// The hermetic builder scrubs the ambient `SOCKET_*` surface so a
// developer's shell can't steer the child, and forces the telemetry
// kill-switch: telemetry resolves its endpoint from `SOCKET_API_URL` /
// `SOCKET_PROXY_URL` env ONLY (`--api-url` is invisible to it), so an
// ambient value would send every run's events to the LIVE API with the
// fake bearer token. Caller-supplied env lands last so explicit
// injections survive the scrub —
// `scan_vendor_emits_no_telemetry_even_with_endpoint_env` seeds those
// endpoint vars deliberately and proves the kill-switch still holds.
for (key, _) in std::env::vars_os() {
if key.to_string_lossy().starts_with("SOCKET_")
&& key.to_string_lossy() != "SOCKET_NO_CONFIG"
{
cmd.env_remove(&key);
}
}
cmd.env("SOCKET_TELEMETRY_DISABLED", "1");
for (k, v) in extra_env {
cmd.env(k, v);
}
Expand Down Expand Up @@ -744,7 +735,7 @@ async fn scan_vendor_fetch_failure_reports_error() {
let tmp = tempfile::tempdir().unwrap();
write_fixture(tmp.path());

let out = Command::new(binary())
let out = hermetic_command(&binary())
.args([
"scan",
"--mode",
Expand All @@ -758,7 +749,6 @@ async fn scan_vendor_fetch_failure_reports_error() {
ORG_SLUG,
])
.current_dir(tmp.path())
.env("SOCKET_TELEMETRY_DISABLED", "1")
.output()
.expect("run");
let code = out.status.code().unwrap_or(-1);
Expand Down Expand Up @@ -795,9 +785,8 @@ async fn scan_mode_sync_conflicts_are_usage_errors() {
&["scan", "--mode", "vendored", "--sync"][..],
&["scan", "--mode", "hosted", "--sync"][..],
] {
let out = Command::new(binary())
let out = hermetic_command(&binary())
.args(argv)
.env("SOCKET_TELEMETRY_DISABLED", "1")
.output()
.expect("run");
let code = out.status.code().unwrap_or(-1);
Expand Down Expand Up @@ -1105,7 +1094,7 @@ async fn scan_prune_reverts_unused_vendored_entry() {

// Plain prune scan (read-only discovery + GC; no --mode vendored, no --mode agent).
let run_prune = || {
let out = Command::new(binary())
let out = hermetic_command(&binary())
.args([
"scan",
"--json",
Expand Down Expand Up @@ -1234,7 +1223,7 @@ async fn scan_prune_reverts_vendored_entry_after_version_upgrade() {
)
.unwrap();

let out = Command::new(binary())
let out = hermetic_command(&binary())
.args([
"scan",
"--json",
Expand Down Expand Up @@ -1456,7 +1445,7 @@ async fn scan_vendor_annotates_mismatched_baseline_and_vendors_anyway() {
)
.unwrap();

let out = Command::new(binary())
let out = hermetic_command(&binary())
.args([
"scan",
"--mode",
Expand Down Expand Up @@ -1617,11 +1606,10 @@ fn run_vendor(root: &Path, extra: &[&str]) -> (i32, serde_json::Value, String) {
let mut argv = vec!["vendor", "--json"];
argv.extend_from_slice(extra);
let fixture = prebuilt_common::Server::project(root);
let out = Command::new(binary())
let out = hermetic_command(&binary())
.env("SOCKET_VENDOR_URL", &fixture.uri)
.args(&argv)
.current_dir(root)
.env("SOCKET_TELEMETRY_DISABLED", "1")
.output()
.expect("run vendor");
let stdout = String::from_utf8_lossy(&out.stdout).into_owned();
Expand Down Expand Up @@ -1735,7 +1723,7 @@ async fn vendor_auto_takes_a_missing_package_from_the_service_without_the_regist
);
seed_manifest_and_blob(tmp.path());
let vendor = |extra: &[&str]| {
let mut cmd = Command::new(binary());
let mut cmd = hermetic_command(&binary());
cmd.args([
"vendor",
"--json",
Expand All @@ -1750,12 +1738,7 @@ async fn vendor_auto_takes_a_missing_package_from_the_service_without_the_regist
])
.args(extra)
.current_dir(tmp.path());
for (key, _) in std::env::vars() {
if key.starts_with("SOCKET_") && key != "SOCKET_NO_CONFIG" {
cmd.env_remove(key);
}
}
let out = cmd.env("SOCKET_TELEMETRY_DISABLED", "1").output().unwrap();
let out = cmd.output().unwrap();
let stdout = String::from_utf8_lossy(&out.stdout);
let v: serde_json::Value = serde_json::from_str(stdout.trim())
.unwrap_or_else(|e| panic!("{e}: {stdout}\n{}", String::from_utf8_lossy(&out.stderr)));
Expand Down Expand Up @@ -1944,7 +1927,7 @@ async fn scan_discovers_lockfile_only_packages_with_warning() {
);

// JSON shape.
let out = Command::new(binary())
let out = hermetic_command(&binary())
.args([
"scan",
"--json",
Expand All @@ -1956,7 +1939,6 @@ async fn scan_discovers_lockfile_only_packages_with_warning() {
ORG_SLUG,
])
.current_dir(tmp.path())
.env("SOCKET_TELEMETRY_DISABLED", "1")
.output()
.expect("run");
let stdout = String::from_utf8_lossy(&out.stdout);
Expand All @@ -1966,7 +1948,7 @@ async fn scan_discovers_lockfile_only_packages_with_warning() {
assert_eq!(v["packages"][0]["notInstalled"], true, "{v}");

// Human output: the table marker + the note.
let out = Command::new(binary())
let out = hermetic_command(&binary())
.args([
"scan",
"--api-url",
Expand All @@ -1979,7 +1961,6 @@ async fn scan_discovers_lockfile_only_packages_with_warning() {
"--yes",
])
.current_dir(tmp.path())
.env("SOCKET_TELEMETRY_DISABLED", "1")
.output()
.expect("run");
let stdout = String::from_utf8_lossy(&out.stdout);
Expand Down Expand Up @@ -2080,7 +2061,7 @@ async fn scan_flags_scoped_lockfile_only_package_despite_api_purl_encoding() {

// JSON: the additive notInstalled flag must be set even though the
// API spelled the purl percent-encoded.
let out = Command::new(binary())
let out = hermetic_command(&binary())
.args([
"scan",
"--json",
Expand All @@ -2092,7 +2073,6 @@ async fn scan_flags_scoped_lockfile_only_package_despite_api_purl_encoding() {
ORG_SLUG,
])
.current_dir(tmp.path())
.env("SOCKET_TELEMETRY_DISABLED", "1")
.output()
.expect("run");
let stdout = String::from_utf8_lossy(&out.stdout);
Expand All @@ -2106,7 +2086,7 @@ async fn scan_flags_scoped_lockfile_only_package_despite_api_purl_encoding() {

// Human table: the [NOT INSTALLED] marker must match through the
// encoding difference too.
let out = Command::new(binary())
let out = hermetic_command(&binary())
.args([
"scan",
"--api-url",
Expand All @@ -2119,7 +2099,6 @@ async fn scan_flags_scoped_lockfile_only_package_despite_api_purl_encoding() {
"--yes",
])
.current_dir(tmp.path())
.env("SOCKET_TELEMETRY_DISABLED", "1")
.output()
.expect("run");
let stdout = String::from_utf8_lossy(&out.stdout);
Expand All @@ -2143,7 +2122,7 @@ async fn scan_apply_skips_lockfile_only_without_error() {
&sri_of(b"unused"),
);

let out = Command::new(binary())
let out = hermetic_command(&binary())
.args([
"scan",
"--json",
Expand All @@ -2158,7 +2137,6 @@ async fn scan_apply_skips_lockfile_only_without_error() {
ORG_SLUG,
])
.current_dir(tmp.path())
.env("SOCKET_TELEMETRY_DISABLED", "1")
.output()
.expect("run");
let stdout = String::from_utf8_lossy(&out.stdout);
Expand Down
Loading
Loading