Skip to content

tests: narrow the secrets-file existence mock - #2576

Merged
berendt merged 1 commit into
mainfrom
stack/2-narrow-secrets-path-mock
Aug 7, 2026
Merged

tests: narrow the secrets-file existence mock#2576
berendt merged 1 commit into
mainfrom
stack/2-narrow-secrets-path-mock

Conversation

@ideaship

@ideaship ideaship commented Aug 6, 2026

Copy link
Copy Markdown
Contributor

The setup_password fixture patched the existence check with a flat return_value:

mocker.patch("osism.utils.rabbitmq.os.path.exists", return_value=exists)

That target reads as module-scoped but resolves to the attribute on the shared os.path module, so for the duration of the patch os.path.exists answers the same way for every caller in the process.

load_rabbitmq_password() then calls osism.tasks.conductor.utils.load_yaml_file, whose import pulls in ansible. Ansible's config manager reads ansible/config/base.yml and checks os.path.exists first, gets the mocked answer, and raises:

AnsibleError: Missing base YAML definition file (bad install?):
  .../site-packages/ansible/config/base.yml

So test_password_file_missing_returns_none fails — with a message pointing at ansible's installation rather than at the mock — whenever ansible-core happens to be importable. It passes today only because the unit-test environment has no ansible-core, which leaves the suite quietly dependent on that staying true.

This answers for the path under test and defers everything else to the real function. The test keeps asserting what it asserted; it just stops answering questions it was not asked.

Verification. Two virtualenvs differing only in whether ansible-core is installed: before, the test fails in the one that has it; after, the module passes in both.

Not required by any other change here, but it removes a tripwire under the next PR in the stack, which installs ansible for the integration job.

🤖 Generated with Claude Code

Base automatically changed from stack/1-interface-fact-key-dots to main August 7, 2026 05:33
@berendt
berendt force-pushed the stack/2-narrow-secrets-path-mock branch from 720d1d7 to ab293be Compare August 7, 2026 05:33
@ideaship
ideaship force-pushed the stack/2-narrow-secrets-path-mock branch from ab293be to 6c17da2 Compare August 7, 2026 05:59
@ideaship
ideaship marked this pull request as ready for review August 7, 2026 05:59

@sourcery-ai sourcery-ai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hey - I've left some high level feedback:

  • The side_effect=lambda path: ... wrapper around os.path.exists in the fixture will break if callers pass keyword-only arguments like dir_fd; consider defining it as lambda path, *args, **kwargs: (exists if path == SECRETS_PATH else real_exists(path, *args, **kwargs)) to preserve the original signature.
  • The hard-coded SECRETS_PATH string in the test duplicates knowledge from the implementation; if possible, import or derive this path from the production module so tests stay aligned if the path changes.
Prompt for AI Agents
Please address the comments from this code review:

## Overall Comments
- The `side_effect=lambda path: ...` wrapper around `os.path.exists` in the fixture will break if callers pass keyword-only arguments like `dir_fd`; consider defining it as `lambda path, *args, **kwargs: (exists if path == SECRETS_PATH else real_exists(path, *args, **kwargs))` to preserve the original signature.
- The hard-coded `SECRETS_PATH` string in the test duplicates knowledge from the implementation; if possible, import or derive this path from the production module so tests stay aligned if the path changes.

Sourcery is free for open source - if you like our reviews please consider sharing them ✨
Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.

The setup_password fixture patched the existence check with a flat
return_value:

  mocker.patch("osism.utils.rabbitmq.os.path.exists", return_value=exists)

That target reads as module-scoped but resolves to the attribute on the
shared os.path module, so for the duration of the patch os.path.exists
answers the same way for every caller in the process.

load_rabbitmq_password() then calls
osism.tasks.conductor.utils.load_yaml_file, whose import pulls in ansible.
Ansible's config manager reads ansible/config/base.yml and checks
os.path.exists first, gets the mocked answer, and raises:

  AnsibleError: Missing base YAML definition file (bad install?):
    .../site-packages/ansible/config/base.yml

so test_password_file_missing_returns_none fails -- with a message that
points at ansible's installation rather than at the mock -- whenever
ansible-core happens to be importable. It passes today only because the
unit-test environment has no ansible-core, which makes the suite quietly
dependent on that staying true.

Answer for the path under test and defer everything else to the real
function. The test keeps asserting what it asserted; it just stops
answering questions it was not asked.

Verified in two virtualenvs differing only in whether ansible-core is
installed: before, the test failed in the one that had it; after, the
module passes in both.

Assisted-by: Claude:claude-opus-5
Signed-off-by: Roger Luethi <luethi@osism.tech>
@ideaship
ideaship force-pushed the stack/2-narrow-secrets-path-mock branch from 6c17da2 to 66c9731 Compare August 7, 2026 06:54
@ideaship
ideaship requested a review from berendt August 7, 2026 06:55
@berendt
berendt merged commit 911ef05 into main Aug 7, 2026
3 checks passed
@berendt
berendt deleted the stack/2-narrow-secrets-path-mock branch August 7, 2026 07:12
@github-project-automation github-project-automation Bot moved this from New to Done in Human Board Aug 7, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

Status: Done

Development

Successfully merging this pull request may close these issues.

3 participants