fix(tests): Mock HF in integration tests

[matthewgrossman]

Problem

TestTrustRemoteCodePermission integration tests create HuggingFace-backed filesets (storage.type=huggingface), which triggers real HF Hub API calls (repo_info, get_hf_file_metadata) during validate_storage() and resolve_config(). These calls are rate-limited by HuggingFace, causing all 6 tests to fail with:

nemo_platform.InternalServerError: Error code: 502 - {'detail': 'Storage backend unavailable:
Rate limited for https://huggingface.co/api/models/Qwen/Qwen3-0.6B/revision/main'}

Setting HF_TOKEN in CI (PR #202) reduced the frequency but didn't eliminate the issue — rate limits still apply to authenticated users, and concurrent CI runs sharing the same token compound the problem.

Strategy

Mock at the Files service layer, not in individual tests. These tests verify authorization behavior (who can set trust_remote_code), not HuggingFace connectivity. The real HF API calls are an unnecessary side effect of fileset creation.

A no_hf_network fixture (defined in conftest.py) patches HuggingfaceStorageImpl.validate_storage and resolve_config to no-ops. This is the same pattern already used by the Files service auth tests in tests_filesets_with_auth_secrets.py. It's better than mocking HfApi directly because it only disables the two methods that egress to HF, leaving everything else (like list_files) intact.

TestTrustRemoteCodePermission uses this fixture via an autouse wrapper so every test in the class gets the mock automatically.

What about other tests?

• Files service HF endpoint tests (test_huggingface_endpoints.py) — already safe, use ASGI transport (no real network)
• Files external storage tests (test_huggingface_storage.py) — gated behind RUN_EXTERNAL_STORAGE_TESTS=1, skipped by default
• Files auth+secrets tests (tests_filesets_with_auth_secrets.py) — already use no_hf_network
• Models parallelism tests — guarded by pytest.importorskip("torch"), skipped in CI (torch not installed)

The only unprotected tests hitting real HF in CI were the 6 TestTrustRemoteCodePermission tests fixed here.

Test plan

• All 6 TestTrustRemoteCodePermission tests pass locally (verified with HF_HUB_OFFLINE=1)
• CI integration tests pass
• No other integration test regressions

Fixes AIRCORE-744

Summary by CodeRabbit

Release Notes

• Tests
  • Enhanced test isolation to prevent unintended external API calls during test execution
  • Improved integration test configuration for authorization behavior verification

[github-actions]

Suite	Lines Covered	Line Rate	Branch Rate
Unit Tests	19462/25829	75.3%	60.9%
Integration Tests	11372/24601	46.2%	20.2%

[mckornfield]

serenity now!

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: ca119e33-bc5e-4ed0-876b-3a46168ad132

📥 Commits

Reviewing files that changed from the base of the PR and between 6b2af4b and df78943.

📒 Files selected for processing (2)

• services/core/models/tests/integration/conftest.py
• services/core/models/tests/integration/test_models_with_auth.py

---

📝 Walkthrough

Walkthrough

no_hf_network fixture gains a monkeypatch that replaces HfApi.repo_info with a function raising RuntimeError, actively blocking live HuggingFace egress. TestTrustRemoteCodePermission gains an autouse _no_hf fixture that activates no_hf_network for all its tests.

Changes

HuggingFace Network Isolation

Layer / File(s)	Summary
Block HfApi.repo_info in no_hf_network fixture services/core/models/tests/integration/conftest.py	Expands docstring and monkeypatches HfApi.repo_info to raise RuntimeError, ensuring any unmocked HuggingFace API call fails loudly.
Wire autouse fixture into TestTrustRemoteCodePermission services/core/models/tests/integration/test_models_with_auth.py	Adds _no_hf autouse fixture depending on no_hf_network so all tests in the class run without HF connectivity.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 60.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately captures the main change: mocking HuggingFace API calls in integration tests to prevent rate-limiting failures.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch mgrossman/aircore-744-python-integration-tests-hit-hugging-face-rate-limits

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}