Skip to content

fix(tests): banner + anon-auth tests no longer depend on live GitHub/portal network (main CI red) - #107962

Closed
teknium1 wants to merge 1 commit into
mainfrom
tools-scout/fix-resolve-token-cache-reset
Closed

teknium1 wants to merge 1 commit into
mainfrom
tools-scout/fix-resolve-token-cache-reset

Conversation

@teknium1

Copy link
Copy Markdown
Collaborator

Two test files went red on main's own push CI (run 34550073898 on 45a6101f3) and now fail every PR, e.g. #107947. Both are hermeticity gaps in the tests, not product bugs.

Root causes

  • test_banner_git_state.py (3 SSH-fastpath tests): they patch banner._upstream_main_sha, but _check_via_local_git resolves a GitHub origin's tip via banner._github_branch_tip — the patch intercepts nothing and the tests silently rely on a live api.github.com call. On runners where that call fails (rate limit / egress), target_rev is None and the tests fail with assert None == 0 / -1. Fix: patch the seam production reads.
  • test_anon_auth_core.py (2 token-path tests): the portal fixture resets the resolve-token memo with monkeypatch.setattr(auth_mod, "_RESOLVE_TOKEN_CACHE", None), but 173105ce6f4 (profile-scoped memo, Sep 10) changed the cache from an Optional[tuple] slot to a dict keyed by hermes_home_key() — .get() on None raises AttributeError inside resolve_nous_access_token. Fix: reset with {} (matches test_resolve_token_memo.py / test_nous_portal_staging_allowlist.py).

Live repro / A/B (sockets blocked in-process to simulate CI egress failure)

Tree Result
base (origin/main), netblock 5 failed — the exact CI failure set
fixed, netblock 40/40 green
fixed, normal network, scripts/run_tests.sh (4 files incl. memo + allowlist siblings) 48 passed, 0 failed

Test-only change, 5 lines. Unblocks every open PR's Python tests job.

Infographic

CI hermetic test fix

… egress

Two main-tip CI failures (red on main push run 34550073898 and on every PR
since, e.g. #107947):

- tests/hermes_cli/test_banner_git_state.py: the three SSH-fastpath tests
  patched banner._upstream_main_sha, but _check_via_local_git resolves the
  GitHub-origin tip via banner._github_branch_tip — the patch intercepted
  nothing and the tests only stayed green when the live GitHub API call
  succeeded. On runners where api.github.com is unreachable/rate-limited the
  real call returns None and the tests fail (assert None == 0 / -1). Patch
  the seam production actually reads.

- tests/hermes_cli/test_anon_auth_core.py: the portal fixture reset the
  resolve_nous_access_token memo with None, but 173105c changed
  _RESOLVE_TOKEN_CACHE from a single Optional slot to a dict keyed by
  hermes_home_key(); .get() on None raises AttributeError and the stale-token
  path never re-exchanges. Reset with {} to match the new shape.

A/B (sockets blocked in-process): base 5 failed — the exact CI set — fixed
40/40 green; both files green with network too.
@github-actions

github-actions Bot commented Sep 11, 2026 •

Copy link
Copy Markdown
Contributor

૮ >ﻌ< ა ci review

ran on dfaaf5b — fix(tests): make banner + anon-auth tests hermetic against C

⚠️ Warnings

OSV vulnerability scan · View job

80 known vulnerabilities found in pinned dependencies.

How to fix:

Review the findings in the Security tab. Update the affected dependencies if a patched version is available.


debug info

CI timings

CI timings · View report · View job

Wall time 5m4s vs 4m24s (+15.2%). 7 job(s) slower, 3 faster, 4 unchanged.

  • Python tests / Run tests: +48.0s
  • OS-specific tests / Windows-only tests: +39.0s
  • Check contributors / check-attribution: +12.0s
  • OSV scan / Emit review status: +9.0s
  • OSV scan / Scan lockfiles / osv-scan: +7.0s

@alt-glitch alt-glitch added type/test Test coverage or test infrastructure P2 Medium — degraded but workaround exists comp/cli CLI entry point, hermes_cli/, setup wizard duplicate This issue or pull request already exists labels Sep 11, 2026
@alt-glitch

Copy link
Copy Markdown
Contributor

This was generated by AI during triage.

Duplicate of #107835 (same two-file fix, byte-equivalent diff; #107866 is another copy). The anon-auth fixture half already merged in #107822; the banner _github_branch_tip seam fix is still pending on main, so #107835 is the canonical open PR for it.

@teknium1

Copy link
Copy Markdown
Collaborator Author

Closing — FIXED ON MAIN. Both hermeticity fixes this PR carries landed independently:

  • test_anon_auth_core.py memo reset as a dict → 0c0983a (test(auth): anon-auth fixture resets the per-profile token memo as a dict)
  • test_banner_git_state.py patching _github_branch_tip → 5d2d5e9 (fix(tests): banner ssh-fastpath tests patch the seam production reads)

Same diff shape, nothing left to salvage. Reopen if either file goes red again on origin/main with a run link.

@teknium1 teknium1 closed this Sep 13, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

comp/cli CLI entry point, hermes_cli/, setup wizard duplicate This issue or pull request already exists P2 Medium — degraded but workaround exists type/test Test coverage or test infrastructure

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants