CI: hermetic spawns in scan/vendor tests (#823) - #1448

LLM Description written by Claude Code:claude-opus-5-5

Refs #823 (slice 5 of the hermetic-spawn migration; the issue stays open for the remaining files).

What was wrong

13 test files (scan_*, top-level vendor_*, vex_terminal_output) spawned socket-patch with a bare Command::new and their own SOCKET_* scrub. The copies disagreed, and many spawns scrubbed nothing:

• 11 of the 13 spawns in scan_vendor_e2e only set SOCKET_TELEMETRY_DISABLED.
• scan_requirements_lock_only and scan_vendor_requirements_unwired scrubbed no SOCKET_* var at all.
• vex_terminal_output, vendor_eject*, scan_rollout_e2e and vendor_jvm_cli also removed SOCKET_NO_CONFIG. So a developer who ran socket login could have their real token picked up through the config fallback.

Change (test-only)

• Every spawn in the 13 files now goes through tests/common/hermetic.rs (hermetic_command / hermetic::binary_command). The hand-rolled loops and the redundant telemetry and no-config sets are gone. Env the tests inject themselves (SOCKET_MAX_NEW_PATCHES, SOCKET_PATCH_FAILPOINT, SOCKET_VENDOR_URL, SOCKET_API_URL, extra_env) is still applied after the builder, so it wins.
• The 13 files leave PENDING_RAW_SPAWNS (126 → 113 on main), so the ratchet in spawn_env_hygiene keeps them hermetic.
• No overlap with CI: hermetic spawns in cli/covgap tests (#823) #1441 (slice 4): different files and non-adjacent list lines, and hermetic.rs is untouched. Whichever merges second rebases cleanly.
• No workflow change. A lean PR run keeps the same job count (~28 Linux jobs) and job-minutes.

Evidence

• cargo test -p socket-patch-cli --all-features over the 14 changed targets: 272/272 pass.
• Hostile shell (SOCKET_DRY_RUN=true SOCKET_JSON=true SOCKET_SILENT=true SOCKET_API_TOKEN=hostile SOCKET_API_URL=http://127.0.0.1:1 SOCKET_PROXY_URL=http://127.0.0.1:1 SOCKET_NO_CONFIG=0 SOCKET_ORG_SLUG=hostile SOCKET_ECOSYSTEMS=cargo SOCKET_OFFLINE=true) over the 13 suites:
  • main: 28 failures. scan_requirements_lock_only 10/10, scan_vendor_e2e 14/58, scan_vendor_requirements_unwired 4/4.
  • this branch: 0 failures, 258/258.
• spawn_env_hygiene 14/14, including no_new_bare_binary_spawns. cargo fmt --all -- --check is clean. The changed code is test-only and CI's cargo clippy --workspace doesn't lint test targets. Running clippy on these test targets reports the same errors as main, all in the shared prebuilt_common/ and common/jvm_env helpers.

/code-review high

No correctness findings. Fixed: stale "every ambient SOCKET_* var scrubbed" doc comments in the vendor_eject* helpers. Not fixed here:

• Extra::Venv removes only VIRTUAL_ENV, but the Python crawler also falls back to CONDA_PREFIX. So scan_requirements_lock_only and scan_vendor_requirements_unwired still remove both by hand, and that stays correct. Widening Extra::Venv changes every suite that uses it, so it belongs in its own change. I'll note it on Spawn every CLI test child through one hermetic Command builder; 10 test files inherit ambient SOCKET_* today #823.
• vex_terminal_output::cli() is now a one-line wrapper around hermetic::binary_command(). I kept it to keep the diff small, since it has many call sites.

Follow-ups for #823: the 113 remaining PENDING_RAW_SPAWNS files (mostly e2e_*, in_process_*, vex_*, vlt_*), the PTY spawns, and Extra::Venv covering CONDA_PREFIX.

🤖 Generated with Claude Code

https://claude.ai/code/session_01YZvGQWp5o1nrjdaai8HpoG

Generated by Claude Code