Repository navigation
Conversation
Pepper gives SALTAPI_* environment variables precedence over the config file, and the test suite never cleared them, despite the pepper_cli fixture claiming to run "inside an empty env". A developer with SALTAPI_URL, SALTAPI_USER or SALTAPI_EAUTH exported would have every CLI test log in to that salt-api with the test credentials instead of the salt-api started by the suite, and unit tests such as test_interactive_logins fail. Add an autouse fixture that removes SALTAPI_*, PEPPER* and MASTER_CONFIG from the environment for every test.
The imp module was removed in Python 3.12, so collecting tests/unit/test_init.py fails there. Load the fresh copy of pepper/__init__.py with importlib.util instead. The version is read from the installed package metadata rather than setup.py, so stop renaming setup.py during the test (which left the checkout broken if the test was interrupted), compare against importlib.metadata instead of setuptools_scm, and cover the not-installed fallback explicitly.
- importlib-metadata<5.0.0 cannot be co-installed with current Salt releases and pepper uses the standard library importlib.metadata. - The cryptography and pyzmq pins conflict with what Salt itself requires (cryptography>=48 for 3006.30 on Python 3.10+); let Salt choose them. - mock and setuptools_scm are no longer used by the test suite. - Bump pytest-salt-factories to 1.0.5.
[os.environ.get("X")] or [...] is always a one element list, so without
API_BACKEND and PYTHON_VERSIONS set the tests session ran with
python=None and --salt-api-backend=rest_None. Split the environment
values and fall back to the full lists when they are unset, moving the
default Python versions to 3.10-3.13.
Also make pip quiet outside CI as the comment intends (CI_RUN is a
string or None, never False) and replace the coverage 5.5 pin, which
predates Python 3.12 support.
Test Python 3.10 through 3.13 against the current Salt releases (3006.30, 3007.17, 3008.5) and master, dropping Python 3.8 and 3.9, which are end of life. Pin actions/checkout and actions/setup-python to the same commit SHAs the Salt repository uses and restrict the workflow token to read-only contents access.
CI runs on GitHub Actions. The Travis and Azure Pipelines definitions target Python 2.7 to 3.8 and Salt 2018.3/2019.2, the Makefile drives the removed tox setup, and nothing uploads coverage to Codecov any more. azure-pipelines.yml also contained a Codecov upload token. Replace the Travis and Codecov badges in the README with the GitHub Actions status badge.
21 tasks
The test minion never completes authentication with the master for Salt 3006 on Python 3.12 and 3.13, or Salt 3007 on Python 3.13, so every test that needs a minion errors during setup. Salt 3007 on Python 3.12 usually passes, but in 7 of 50 recent CI jobs the minion failed to start, stopped answering, or took about a minute per call. Five of those jobs failed and the slowest ran for 81 minutes, against 2 to 7 minutes normally, so exclude it as well. Salt 3006 and 3007 declare support up to Python 3.10; both pass on 3.11, so keep those.
On Salt 3008 the netapi ssh client authorizes the request itself and looks the token up in salt.cache, which does not find the token minted through /login or /token, so salt-api answers 401 for both the session and /run paths. Every other client still passes on 3008. Mark the test xfail (non-strict) until the cause is understood instead of letting it hold the rest of the matrix red.
A job normally finishes in 2 to 7 minutes. When the test minion hangs, the job otherwise runs until GitHub's 6 hour limit and holds a runner the whole time.
ggiesen
force-pushed
the
fix-test-suite-ci
branch
from
November 5, 2026 21:23
a599b50 to
8906214
Compare
3 tasks done
test_token wrote a real ~/.peppercache, and a developer's ~/.pepperrc could leak into the tests. Point HOME (and USERPROFILE) at an empty directory for every test.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What does this PR do?
Gets the test suite and CI working again against supported Salt and Python releases, as the first step of the plan in #622.
SALTAPI_*/PEPPER*/MASTER_CONFIGenvironment (Test suite uses SALTAPI_* variables from the caller's environment #620), and give each test an empty home directory, so no test reads a real~/.pepperrcor writes a real~/.peppercache.impmodule (removed in Python 3.12) intests/unit/test_init.py.importlib-metadata<5,cryptography/pyzmqpins,mock,setuptools_scm) and bump pytest-salt-factories to 1.0.5.python=NoneunlessPYTHON_VERSIONS/API_BACKENDwere set.actions/checkoutandactions/setup-pythonto the same SHAs Salt uses, with read-only token permissions.test_ssh_clientis marked as a non-strict xfail on Salt 3008+: salt-api returns 401 for the ssh client there (it looks the token up insalt.cacheand does not find it) while every other client passes. I'll follow up on that separately.What issues does this PR fix or reference?
Fixes #620
Fixes #222
Previous Behavior
The test suite could not be installed alongside current Salt releases,
tests/unit/test_init.pyfailed to import on Python 3.12, and tests used anySALTAPI_URL/SALTAPI_USER/SALTAPI_EAUTHexported in the caller's shell.New Behavior
The suite installs and passes on the matrix above (run on my fork: https://github.com/ggiesen/pepper/actions/runs/42174287213) and ignores the caller's pepper environment.
Merge requirements satisfied?
changelog/directoryCommits signed with GPG?
No