tests: narrow the secrets-file existence mock - #2576
Merged
Conversation
This was referenced Aug 6, 2026
berendt
force-pushed
the
stack/2-narrow-secrets-path-mock
branch
from
August 7, 2026 05:33
720d1d7 to
ab293be
Compare
ideaship
force-pushed
the
stack/2-narrow-secrets-path-mock
branch
from
August 7, 2026 05:59
ab293be to
6c17da2
Compare
ideaship
marked this pull request as ready for review
August 7, 2026 05:59
There was a problem hiding this comment.
Hey - I've left some high level feedback:
- The
side_effect=lambda path: ...wrapper aroundos.path.existsin the fixture will break if callers pass keyword-only arguments likedir_fd; consider defining it aslambda path, *args, **kwargs: (exists if path == SECRETS_PATH else real_exists(path, *args, **kwargs))to preserve the original signature. - The hard-coded
SECRETS_PATHstring in the test duplicates knowledge from the implementation; if possible, import or derive this path from the production module so tests stay aligned if the path changes.
Prompt for AI Agents
Please address the comments from this code review:
## Overall Comments
- The `side_effect=lambda path: ...` wrapper around `os.path.exists` in the fixture will break if callers pass keyword-only arguments like `dir_fd`; consider defining it as `lambda path, *args, **kwargs: (exists if path == SECRETS_PATH else real_exists(path, *args, **kwargs))` to preserve the original signature.
- The hard-coded `SECRETS_PATH` string in the test duplicates knowledge from the implementation; if possible, import or derive this path from the production module so tests stay aligned if the path changes.Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
The setup_password fixture patched the existence check with a flat
return_value:
mocker.patch("osism.utils.rabbitmq.os.path.exists", return_value=exists)
That target reads as module-scoped but resolves to the attribute on the
shared os.path module, so for the duration of the patch os.path.exists
answers the same way for every caller in the process.
load_rabbitmq_password() then calls
osism.tasks.conductor.utils.load_yaml_file, whose import pulls in ansible.
Ansible's config manager reads ansible/config/base.yml and checks
os.path.exists first, gets the mocked answer, and raises:
AnsibleError: Missing base YAML definition file (bad install?):
.../site-packages/ansible/config/base.yml
so test_password_file_missing_returns_none fails -- with a message that
points at ansible's installation rather than at the mock -- whenever
ansible-core happens to be importable. It passes today only because the
unit-test environment has no ansible-core, which makes the suite quietly
dependent on that staying true.
Answer for the path under test and defer everything else to the real
function. The test keeps asserting what it asserted; it just stops
answering questions it was not asked.
Verified in two virtualenvs differing only in whether ansible-core is
installed: before, the test failed in the one that had it; after, the
module passes in both.
Assisted-by: Claude:claude-opus-5
Signed-off-by: Roger Luethi <luethi@osism.tech>
ideaship
force-pushed
the
stack/2-narrow-secrets-path-mock
branch
from
August 7, 2026 06:54
6c17da2 to
66c9731
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The
setup_passwordfixture patched the existence check with a flatreturn_value:That target reads as module-scoped but resolves to the attribute on the shared
os.pathmodule, so for the duration of the patchos.path.existsanswers the same way for every caller in the process.load_rabbitmq_password()then callsosism.tasks.conductor.utils.load_yaml_file, whose import pulls in ansible. Ansible's config manager readsansible/config/base.ymland checksos.path.existsfirst, gets the mocked answer, and raises:So
test_password_file_missing_returns_nonefails — with a message pointing at ansible's installation rather than at the mock — whenever ansible-core happens to be importable. It passes today only because the unit-test environment has no ansible-core, which leaves the suite quietly dependent on that staying true.This answers for the path under test and defers everything else to the real function. The test keeps asserting what it asserted; it just stops answering questions it was not asked.
Verification. Two virtualenvs differing only in whether ansible-core is installed: before, the test fails in the one that has it; after, the module passes in both.
Not required by any other change here, but it removes a tripwire under the next PR in the stack, which installs ansible for the integration job.
🤖 Generated with Claude Code