Isolate tests from local machine's auth and git configuration - #14128
Merged
Conversation
Matches the convention already used by internal/prompter, pkg/cmd/run/shared, and pkg/cmd/workflow/shared for their test helper files. Co-authored-by: Copilot App <[email protected]>
Config from GIT_CONFIG_COUNT and GIT_CONFIG_PARAMETERS is command line scope, which outranks both the global and system files, so pointing GIT_CONFIG_GLOBAL at an empty file was not enough on its own. An inherited safe.bareRepository=explicit made git refuse to open the bare fixtures at all. Replaces the copy of this helper in each of the two packages that needed it. Co-authored-by: Copilot App <[email protected]>
go-gh reads GH_TOKEN and friends ahead of any stored config, so isolating the config file left tests authenticated for anyone with a token exported. Nine packages failed as a result. The token test set its own env vars before building the config, which the clearing would undo, so it now sets them after. Co-authored-by: Copilot App <[email protected]>
The helper only ever produced an empty config, so tests needing populated hosts had to reach for the mock instead and lost the env isolation that comes with it. Test_mightBeGHESUser was one of those. Its cases named "no env vars" never cleared any, so they failed whenever GH_ENTERPRISE_TOKEN or GH_HOST was set. Its table now holds config strings rather than prebuilt configs. Co-authored-by: Copilot App <[email protected]>
Neither mock constructor had a doc comment, so nothing signalled which of the three to reach for. Each now says what it does and points at the other. Co-authored-by: Copilot App <[email protected]>
NewBlankConfig and NewFromString gave no hint that what came back was a mock, which made them the default choice even where the real config was wanted. Every other mock constructor in the repo already announces itself, as in NewMockPrompter and NewMockFinder. Co-authored-by: Copilot App <[email protected]>
Contributor
There was a problem hiding this comment.
Pull request overview
Hardens tests against local authentication and Git configuration leakage.
Changes:
- Isolates auth and Git environment settings.
- Adds configurable isolated configs and fixes GHES-user tests.
- Renames config mock constructors and migrates callers.
Show a summary per file
| File | Description |
|---|---|
pkg/cmdutil/auth_check_test.go |
Updates isolated-config invocation. |
pkg/cmd/variable/set/set_test.go |
Migrates config mocks. |
pkg/cmd/variable/list/list_test.go |
Migrates config mocks. |
pkg/cmd/variable/get/get_test.go |
Migrates config mocks. |
pkg/cmd/variable/delete/delete_test.go |
Migrates config mocks. |
pkg/cmd/status/status_test.go |
Migrates config mock. |
pkg/cmd/ssh-key/list/list_test.go |
Migrates config mock. |
pkg/cmd/ssh-key/delete/delete_test.go |
Migrates config mock. |
pkg/cmd/ssh-key/add/add_test.go |
Migrates config mock. |
pkg/cmd/skills/update/update_test.go |
Migrates config mocks. |
pkg/cmd/skills/search/search_test.go |
Migrates config mocks. |
pkg/cmd/send-telemetry/send_telemetry_test.go |
Migrates config mock. |
pkg/cmd/secret/set/set_test.go |
Migrates config mocks. |
pkg/cmd/secret/list/list_test.go |
Migrates config mocks. |
pkg/cmd/secret/delete/delete_test.go |
Migrates config mocks. |
pkg/cmd/search/shared/shared_test.go |
Migrates config mock. |
pkg/cmd/search/code/code_test.go |
Migrates config mocks. |
pkg/cmd/run/view/view_test.go |
Migrates config mock. |
pkg/cmd/root/help_test.go |
Migrates config mock. |
pkg/cmd/root/extension_registration_test.go |
Migrates config mock. |
pkg/cmd/repo/view/view_test.go |
Migrates config mock. |
pkg/cmd/repo/rename/rename_test.go |
Migrates config mock. |
pkg/cmd/repo/list/list_test.go |
Migrates config mocks. |
pkg/cmd/repo/license/view/view_test.go |
Migrates config mock. |
pkg/cmd/repo/license/list/list_test.go |
Migrates config mock. |
pkg/cmd/repo/gitignore/view/view_test.go |
Migrates config mock. |
pkg/cmd/repo/gitignore/list/list_test.go |
Migrates config mock. |
pkg/cmd/repo/fork/fork_test.go |
Updates isolated-config invocation. |
pkg/cmd/repo/create/create_test.go |
Migrates config mock. |
pkg/cmd/repo/clone/clone_test.go |
Migrates config mock. |
pkg/cmd/release/create/create_test.go |
Migrates config mock. |
pkg/cmd/project/unlink/unlink_test.go |
Migrates config mocks. |
pkg/cmd/project/link/link_test.go |
Migrates config mocks. |
pkg/cmd/pr/status/status_test.go |
Migrates config mock. |
pkg/cmd/pr/review/review_test.go |
Migrates config mock. |
pkg/cmd/pr/create/create_test.go |
Migrates config mocks. |
pkg/cmd/pr/checkout/checkout_test.go |
Migrates config mocks. |
pkg/cmd/org/list/list_test.go |
Migrates config mock. |
pkg/cmd/issue/view/view_test.go |
Migrates config mock. |
pkg/cmd/issue/unpin/unpin_test.go |
Migrates config mock. |
pkg/cmd/issue/transfer/transfer_test.go |
Migrates config mock. |
pkg/cmd/issue/status/status_test.go |
Migrates config mock. |
pkg/cmd/issue/reopen/reopen_test.go |
Migrates config mock. |
pkg/cmd/issue/pin/pin_test.go |
Migrates config mock. |
pkg/cmd/issue/list/list_test.go |
Migrates config mock. |
pkg/cmd/issue/delete/delete_test.go |
Migrates config mock. |
pkg/cmd/issue/create/create_test.go |
Migrates config mocks. |
pkg/cmd/gpg-key/list/list_test.go |
Migrates config mock. |
pkg/cmd/gpg-key/delete/delete_test.go |
Migrates config mock. |
pkg/cmd/gpg-key/add/add_test.go |
Migrates config mock. |
pkg/cmd/gist/view/view_test.go |
Migrates config mock. |
pkg/cmd/gist/rename/rename_test.go |
Migrates config mock. |
pkg/cmd/gist/list/list_test.go |
Migrates config mock. |
pkg/cmd/gist/edit/edit_test.go |
Migrates config mock. |
pkg/cmd/gist/delete/delete_test.go |
Migrates config mock. |
pkg/cmd/gist/create/create_test.go |
Migrates config mock. |
pkg/cmd/gist/clone/clone_test.go |
Migrates config mock. |
pkg/cmd/factory/default_test.go |
Migrates config mocks. |
pkg/cmd/extension/manager_test.go |
Migrates config mock. |
pkg/cmd/extension/command_test.go |
Migrates config mock. |
pkg/cmd/extension/browse/browse_test.go |
Migrates config mock. |
pkg/cmd/config/set/set_test.go |
Migrates config mocks. |
pkg/cmd/config/list/list_test.go |
Migrates config mocks. |
pkg/cmd/config/get/get_test.go |
Migrates config mocks. |
pkg/cmd/auth/token/token_test.go |
Isolates auth before setting test variables. |
pkg/cmd/auth/switch/switch_test.go |
Updates isolated-config invocation. |
pkg/cmd/auth/status/status_test.go |
Updates isolated-config invocation. |
pkg/cmd/auth/shared/gitcredentials/updater_test.go |
Uses shared Git isolation. |
pkg/cmd/auth/shared/gitcredentials/helper_config_test.go |
Replaces local Git isolation helper. |
pkg/cmd/auth/setupgit/setupgit_test.go |
Updates isolated-config invocation. |
pkg/cmd/auth/refresh/refresh_test.go |
Updates isolated-config invocation. |
pkg/cmd/auth/logout/logout_test.go |
Updates isolated-config invocations. |
pkg/cmd/auth/login/login_test.go |
Updates isolated-config invocations. |
pkg/cmd/attestation/verify/verify_integration_test.go |
Migrates config mocks. |
pkg/cmd/api/api_test.go |
Migrates config mocks. |
pkg/cmd/alias/set/set_test.go |
Migrates config mock. |
pkg/cmd/alias/list/list_test.go |
Migrates string-backed config mock. |
pkg/cmd/alias/imports/import_test.go |
Migrates string-backed config mock. |
pkg/cmd/alias/delete/delete_test.go |
Migrates string-backed config mock. |
pkg/cmd/agent-task/agent_task_test.go |
Migrates config mocks. |
internal/ghcmd/cmd_test.go |
Isolates GHES tests and migrates mocks. |
internal/config/test.go |
Defines renamed and isolated config helpers. |
internal/config/auth_config_test.go |
Updates isolated-config invocation. |
git/test.go |
Adds shared Git isolation helper. |
git/client_test.go |
Isolates real Git invocations. |
cmd/gen-docs/main.go |
Migrates documentation generator config. |
Review details
Tip
Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Suppressed comments (3)
git/test.go:23
- 🛑 Requirement:
GIT_CONFIG_COUNTmust not be set to an empty string. Git parses any present value as an integer, so this causesfatal: bogus count in GIT_CONFIG_COUNTand every real Git invocation using this helper fails even in a clean environment. Use0to disable inherited key/value pairs while preservingt.Setenvcleanup.
t.Setenv("GIT_CONFIG_COUNT", "")
internal/config/test.go:26
- The claim that this mock never writes is incorrect: its
WriteFuncdelegates tocfg.Write, which calls the real go-gh filesystem writer. Tests avoid writes only when they do not callWriteor override/isolate it, so document that behavior explicitly to prevent callers from relying on a false safety guarantee.
internal/config/test.go:139 - 🛑 Requirement: Add a deterministic regression test that sets each auth/host variable before calling this helper and verifies the returned real config cannot observe it. The current callers set their test variables only after isolation, so CI with a clean environment would still pass if one of these newly added clearing rules were removed.
- Files reviewed: 86/86 changed files
- Comments generated: 1
- Review effort level: Balanced
babakks
approved these changes
Aug 11, 2026
babakks
left a comment
Member
There was a problem hiding this comment.
LGTM! Thanks for fixing this! 🙌
tmeijn
pushed a commit
to tmeijn/dotfiles
that referenced
this pull request
Aug 21, 2026
This MR contains the following updates: | Package | Update | Change | |---|---|---| | [cli/cli](https://github.com/cli/cli) | minor | `v2.97.0` → `v2.98.0` | MR created with the help of [el-capitano/tools/renovate-bot](https://gitlab.com/el-capitano/tools/renovate-bot). **Proposed changes to behavior should be submitted there as MRs.** --- ### Release Notes <details> <summary>cli/cli (cli/cli)</summary> ### [`v2.98.0`](https://github.com/cli/cli/releases/tag/v2.98.0): GitHub CLI 2.98.0 [Compare Source](cli/cli@v2.97.0...v2.98.0) #### Security A security vulnerability has been identified, and fixed, that binds the local forwarded port to all available network interfaces by default. Users of `gh codespace ports forward` are advised to update `gh` to version `v2.98.0` as soon as possible. For more information see: <GHSA-vfhh-p7hm-pxfh> #### Support worktrees in `pr checkout` Users can now checkout a pull request into a git worktree by using the new `--worktree PATH` flag in `gh pr checkout`: ```shell gh pr checkout 12 --worktree ../wt-feature ``` #### Add semantic search to `search issues` The `gh search issues` command now supports semantic search for issues. Users can select the search type by passing the `--search-type` flag: ```shell gh search issues --search-type semantic ... gh search issues --search-type hybrid ... ``` For more information about semantic search see: ["Improved Search for github issues is now generally available"](https://github.blog/changelog/2026-04-02-improved-search-for-github-issues-is-now-generally-available/). #### What's Changed ##### ✨ Features - Add --worktree flag to gh pr checkout by [@​tidy-dev](https://github.com/tidy-dev) in [#​13946](cli/cli#13946) - Set GH\_EXTENSION=1 when gh invokes an extension by [@​williammartin](https://github.com/williammartin) in [#​14072](cli/cli#14072) - Add --search-type flag for semantic and hybrid issue search by [@​michaeljacholke](https://github.com/michaeljacholke) in [#​14006](cli/cli#14006) ##### 🐛 Fixes - Fix `RESTWithNext` error type, repairing `gh status` and attestation retries by [@​williammartin](https://github.com/williammartin) in [#​13988](cli/cli#13988) - Trim spaces when parsing X-Oauth-Scopes in `gh release create` by [@​williammartin](https://github.com/williammartin) in [#​14065](cli/cli#14065) - Fix project item-add output for non-TTY by [@​zwick](https://github.com/zwick) in [#​14056](cli/cli#14056) ##### 📚 Docs & Chores - Slim down dependabot triage comments by [@​williammartin](https://github.com/williammartin) in [#​14019](cli/cli#14019) - Require explicit MR review ownership by [@​williammartin](https://github.com/williammartin) in [#​14028](cli/cli#14028) - Collapse spam triage into the agentic issue-triage workflow by [@​williammartin](https://github.com/williammartin) in [#​14027](cli/cli#14027) - Run Dependabot triage every hour by [@​sergiou87](https://github.com/sergiou87) in [#​14030](cli/cli#14030) - Route deploy key requests through api.Client by [@​williammartin](https://github.com/williammartin) in [#​13989](cli/cli#13989) - Route ssh key requests through api.Client by [@​williammartin](https://github.com/williammartin) in [#​13994](cli/cli#13994) - Route gpg key requests through api.Client by [@​williammartin](https://github.com/williammartin) in [#​13997](cli/cli#13997) - Route autolink requests through api.Client by [@​williammartin](https://github.com/williammartin) in [#​14013](cli/cli#14013) - Route extension requests through api.Client by [@​williammartin](https://github.com/williammartin) in [#​14059](cli/cli#14059) - Route release creation through api.Client by [@​williammartin](https://github.com/williammartin) in [#​14062](cli/cli#14062) - Tell agents to use the MR template in AGENTS.md by [@​williammartin](https://github.com/williammartin) in [#​14074](cli/cli#14074) - Make Dependabot triage cheaper and more decisive by [@​williammartin](https://github.com/williammartin) in [#​14079](cli/cli#14079) - Route release deletions through api.Client by [@​williammartin](https://github.com/williammartin) in [#​14077](cli/cli#14077) - Give Dependabot triage a real reachability check by [@​williammartin](https://github.com/williammartin) in [#​14087](cli/cli#14087) - Restore automatic spam issue closure by [@​williammartin](https://github.com/williammartin) in [#​14088](cli/cli#14088) - Add a scheduled tech debt burndown skill by [@​williammartin](https://github.com/williammartin) in [#​14095](cli/cli#14095) - Use reflect.Pointer instead of deprecated reflect.Ptr by [@​williammartin](https://github.com/williammartin) in [#​14098](cli/cli#14098) - Clarify what belongs in the MR template's testing section by [@​williammartin](https://github.com/williammartin) in [#​14103](cli/cli#14103) - Rename cli-code-reviewer skill to code-review by [@​BagToad](https://github.com/BagToad) in [#​14116](cli/cli#14116) - Add aw-actions group to dependabot configuration by [@​babakks](https://github.com/babakks) in [#​14123](cli/cli#14123) - Isolate tests from local machine's auth and git configuration by [@​BagToad](https://github.com/BagToad) in [#​14128](cli/cli#14128) - Don't ask for feature detection cleanup comments when not needed by [@​babakks](https://github.com/babakks) in [#​14139](cli/cli#14139) - Accept pre-release tags in deployment validation by [@​BagToad](https://github.com/BagToad) in [#​14193](cli/cli#14193) - ci: add temporary step to verify Linux repo signing keys by [@​babakks](https://github.com/babakks) in [#​14202](cli/cli#14202) - Revert "ci: add temporary step to verify Linux repo signing keys" by [@​babakks](https://github.com/babakks) in [#​14203](cli/cli#14203) - Fix issue triage action compatibility \[skip changelog] by [@​tidy-dev](https://github.com/tidy-dev) in [#​14207](cli/cli#14207) #####Dependencies - chore(deps): bump github.com/sigstore/sigstore-go from 1.2.2 to 1.3.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​14047](cli/cli#14047) - chore(deps): bump the codeql-actions group across 1 directory with 3 updates by [@​dependabot](https://github.com/dependabot)\[bot] in [#​14049](cli/cli#14049) - chore(deps): bump google.golang.org/grpc from 1.82.1 to 1.83.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​14048](cli/cli#14048) - chore(deps): bump github.com/google/go-containerregistry from 0.21.7 to 0.21.8 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​14066](cli/cli#14066) - chore(deps): bump actions/attest from 4.2.1 to 4.2.2 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​14100](cli/cli#14100) - chore(deps): bump azure/login from 3.0.0 to 3.0.1 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​14101](cli/cli#14101) - chore(deps): bump the codeql-actions group across 1 directory with 3 updates by [@​dependabot](https://github.com/dependabot)\[bot] in [#​14091](cli/cli#14091) - chore(deps): bump github/gh-aw-actions/setup-cli from 0.83.4 to 0.85.4 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​14068](cli/cli#14068) - chore(deps): bump github.com/google/go-containerregistry from 0.21.8 to 0.21.9 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​14119](cli/cli#14119) - chore(deps): bump github.com/klauspost/compress from 1.19.1 to 1.19.2 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​14120](cli/cli#14120) - chore(deps): bump the aw-actions group with 2 updates by [@​dependabot](https://github.com/dependabot)\[bot] in [#​14147](cli/cli#14147) - chore: sign APT repository with both keys by [@​babakks](https://github.com/babakks) in [#​13271](cli/cli#13271) - chore(deps): bump github.com/yuin/goldmark from 1.8.4 to 1.8.5 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​14029](cli/cli#14029) - chore(deps): bump actions/attest from 4.2.0 to 4.2.1 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​14050](cli/cli#14050) - Bump golangci-lint in CI to v2.12.2 by [@​williammartin](https://github.com/williammartin) in [#​14102](cli/cli#14102) - chore(deps): bump the aw-actions group with 2 updates by [@​dependabot](https://github.com/dependabot)\[bot] in [#​14124](cli/cli#14124) - chore(deps): bump google.golang.org/protobuf from 1.36.11 to 1.36.12 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​14140](cli/cli#14140) - Upgrade gh-aw workflows to v0.85.4 by [@​tidy-dev](https://github.com/tidy-dev) in [#​14141](cli/cli#14141) - Bump Go to 1.26.6 by [@​github-actions](https://github.com/github-actions)\[bot] in [#​14143](cli/cli#14143) - chore: bump go to 1.26.7 by [@​babakks](https://github.com/babakks) in [#​14205](cli/cli#14205) - chore(deps): bump github.com/stretchr/testify from 1.11.1 to 1.12.1 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​14204](cli/cli#14204) - chore(deps): bump the codeql-actions group across 1 directory with 3 updates by [@​dependabot](https://github.com/dependabot)\[bot] in [#​14169](cli/cli#14169) - chore(deps): bump golang.org/x/crypto from 0.54.0 to 0.55.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​14164](cli/cli#14164) - chore(deps): bump charm.land/lipgloss/v2 from 2.0.5 to 2.0.6 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​14166](cli/cli#14166) - Bump gh-aw-actions to v0.87.1 and recompile agentic workflows by [@​BagToad](https://github.com/BagToad) in [#​14210](cli/cli#14210) #### New Contributors - [@​sergiou87](https://github.com/sergiou87) made their first contribution in [#​14030](cli/cli#14030) - [@​michaeljacholke](https://github.com/michaeljacholke) made their first contribution in [#​14006](cli/cli#14006) **Full Changelog**: <cli/cli@v2.97.0...v2.98.0> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever MR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this MR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this MR, check this box --- This MR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yODguMCIsInVwZGF0ZWRJblZlciI6IjQzLjI4OC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJSZW5vdmF0ZSBCb3QiLCJhdXRvbWF0aW9uOmJvdC1hdXRob3JlZCIsImRlcGVuZGVuY3ktdHlwZTo6bWlub3IiXX0=-->
1 task
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
This fixes some test failures that are a result of a not-fully-isolated testing setup.
There are two leaks:
NewIsolatedTestConfigisolates the config file, but go-gh readsGH_TOKENand friends first. Anyone with a token exported gets an authenticated config from a helper meant to return a blank one.gittests redirectGIT_CONFIG_GLOBAL, which is not enough.GIT_CONFIG_COUNTandGIT_CONFIG_PARAMETERSare command line scope and outrank it.This also fixes
Test_mightBeGHESUser, whose cases named "no env vars" never cleared any.How did you test this change?
One shell throughout, exporting
GH_TOKEN,GH_HOST, andsafe.bareRepository=explicitviaGIT_CONFIG_COUNT:trunk: 11 packages fail.The expectation is that the suite ignores its environment entirely, so I ran the same command in three more: a normal shell, a stripped CI-like one, and one with a
~/.gitconfigsettingcommit.gpgsign,core.autocrlf, and acredential.helper.Key points
NewIsolatedTestConfig, that felt like the best solution with the goal of funneling test configs, rather than a second helper you have to know to reach for.Notes for reviewers
a4ed81cRename config stub file totest.go. Rename only, to matchgit/test.go.5e8ec5dIsolate git config in tests that shell out to git. Fixes the git leak. Two copies of a leaky local helper become one exportedgit.IsolateConfig.e5b9c16Clear auth environment variables in isolated test config. Fixes the auth leak.1e5e85cAccept config content inNewIsolatedTestConfig. The new parameter lets tests that need populated hosts use it, which is howTest_mightBeGHESUsergets fixed.efd568eDocument when to use the config mock or the isolated config. Comments only.5dfc6b0Rename config mock constructors to match repo convention. Mechanical, 73 files, skippable.Commits 2 to 4 are the substance, and most of that is call sites.
Authorship and follow-up
Who wrote this:
Who answers review comments: