test: reject unsafe live lab inputs before network access

workflow:

  rules:

    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'

    - if: '$CI_PIPELINE_SOURCE == "push" && ($CI_COMMIT_BRANCH == "master" || $CI_COMMIT_BRANCH == "main")'

    - if: '$CI_PIPELINE_SOURCE == "push" && $CI_OPEN_MERGE_REQUESTS'

      when: never

    - when: always

image: python:3.12-slim

stages:

    scenario.nef_http = lambda *args: SimpleNamespace(status_code=200, json=lambda: [])

    assert scenario.cleanup() == []

    assert deleted == ["own-policy"]

def live_runner():

    import importlib.util

    path = Path(__file__).parents[3] / "ci/sdk_live.py"

    spec = importlib.util.spec_from_file_location("sdk_live", path)

    module = importlib.util.module_from_spec(spec)

    spec.loader.exec_module(module)

    return module

def test_live_mode_rejects_unprotected_refs(monkeypatch):

    module = live_runner()

    monkeypatch.setenv("CI_COMMIT_REF_PROTECTED", "false")

    with pytest.raises(ValueError, match="protected lab ref"):

        module.main()

def test_live_mode_missing_credentials_fails_before_network(monkeypatch):

    module = live_runner()

    monkeypatch.setenv("CI_COMMIT_REF_PROTECTED", "true")

    monkeypatch.delenv("SDK_LAB_PROFILE", raising=False)

    monkeypatch.setattr(module, "urlopen", lambda *a, **kw: pytest.fail("Unexpected network access"))

    with pytest.raises(ValueError, match="SDK_LAB_PROFILE"):

        module.main()

def test_live_mode_target_mismatch_fails_before_network(monkeypatch, tmp_path, profile):

    module = live_runner()

    monkeypatch.setenv("CI_COMMIT_REF_PROTECTED", "true")

    monkeypatch.setenv("SDK_CHECKPOINT", "endpoints")

    files = {

        "SDK_LAB_PROFILE": profile,

        "OOP_E2E_SETTINGS": {"operators": [{"host": "another-lab"}]},

        "KUBECONFIG": {},

    }

    for key, value in files.items():

        path = tmp_path / key

        path.write_text(json.dumps(value))

        monkeypatch.setenv(key, str(path))

    monkeypatch.setattr(module, "urlopen", lambda *a, **kw: pytest.fail("Unexpected network access"))

    with pytest.raises(ValueError, match="different targets"):

        module.main()