CI: fold last top-level covgap test binaries (#1089)

[Mikola Lysenko (mikolalysenko)]

LLM Description written by Claude Code:claude-opus-5-5

Refs #1089 (the last two top-level covgap_* / coverage_fix_* test binaries). The tracking issue stays open: the update/ and scan/ covgap files remain for later slices.

Root cause

Two coverage-gap files still built as their own test binaries, and one of them carried a copy of another suite's private harness instead of living in its command's suite.

What changes

• covgap_utils_socket_cli_config.rs is deleted (−157 lines). Its harness was a copy of cli_config_fallback.rs's private helpers. Its one check, the SOCKET_DEBUG provenance line for a config-sourced apiBaseUrl, moves into cli_config_fallback.rs::config_token_and_api_base_url_authenticate, which already builds the same fixture. That test now runs human and --json, with and without SOCKET_DEBUG: the line prints only under the flag.
• coverage_fix_scan_hosted_dryrun_vendored.rs → scan/hosted_dryrun_vendored.rs, in the scan suite binary. It now uses the suite's shared helpers: hosted_fixture::{hosted_skipped, warning_detail}, common::envelope::{codes_in, hosted_pins}, and vlt_vendored::vendored_project for the vlt fixture. That replaces four private copies and a 30-line duplicate of the vlt vendored fixture.
  • Its five tests drop #[serial]. They set no process-global state and only spawn hermetic children in their own tempdirs against their own mock servers.
  • It also fixes one pre-existing clippy::unnecessary_map_on_constructor in the moved file.
• scan/main.rs mounts prebuilt_common once. Before, three modules each mounted their own copy. vlt_hosted_common/vendored.rs still mounts its own copy, because that file is path-included by other suites too. Changing that is out of scope here.
• scripts/ci-test-durations.json drops the two targets and adds their recorded time to scan (12.35 → 13.96 s) and cli_config_fallback (0.18 → 0.26 s), so the shard balance stays the same.

Three 4+-word .contains checks stay in hosted_dryrun_vendored.rs. They pin the "would be written to a new file" variant of the redirect_pnpm_trust_lockfile / redirect_npm_allow_remote guidance, and the envelope has no structured field for that (rewrittenFiles names the file but doesn't say whether it is new). Replacing them would need a production change, which is out of scope for a test-only slice.

CI cost (lean PR run)

• Job count is unchanged: about 28 Linux jobs, ~8 min wall.
• Each cargo test --workspace build compiles and links 2 fewer test binaries: the test shards, coverage and the e2e build that compiles every CLI test. That is a few seconds of link time per job, so job-minutes go slightly down. No jobs move between tiers.

Test evidence

• cargo test -p socket-patch-cli --all-features --test cli_config_fallback --test scan: 11 + 245 passed. Before this PR it was 11 + 253, and the drop of 8 is the duplicated prebuilt_common selftests. The moved tests all pass in the scan binary: hosted_dryrun_vendored::* 5/5.
• cargo check -p socket-patch-cli --all-features --tests: every test target compiles. A full local cargo test -p socket-patch-cli ran out of this session's disk allowance while linking about 240 test binaries, so CI runs the full suite.
• cargo fmt --all -- --check and cargo clippy --locked --workspace --all-features -- -D warnings (the CI form) are clean.
• python3 -m pytest scripts/tests -q: 342 passed, 6 skipped. That includes test_ci_test_shard.py against the updated durations file.
• /code-review high raised 7 findings. Fixed: the dropped --json silence check, three duplicated helpers, the duplicated vlt fixture, and the unneeded #[serial]. Not fixed: the vlt_vendored second prebuilt_common copy (pre-existing, shared with other suites; see above). The warning_detail name clash went away when the local copy was deleted.

🤖 Generated with Claude Code

https://claude.ai/code/session_015kU2j3qoD5buwCAkuEiZaq

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

BugBot review

---

Generated by Claude Code

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 777911b. Configure here.}

[Mikola Lysenko (mikolalysenko)]

Ready for review at 777911b.

• CI: 35/35 run checks green (plus 1 neutral), 50 skipped by path filters (86 total); no main-wide failures.
• Bugbot: reviewed 777911b, no findings.
• Mergeable against main, no conflicts; CHANGELOG.md untouched.

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

Final review brief: #1568 at 777911b

What it does: This PR only changes tests and CI timing data. It folds the last two top-level covgap test binaries into existing ones, which cuts per-binary link time for #1089:

• The provenance test in covgap_utils_socket_cli_config.rs moves into cli_config_fallback.rs, where it now covers all four json/debug combinations.
• The five hosted dry-run tests move unchanged into the scan binary and now use shared fixtures and envelope helpers.

Risk: low. No production code changes. Every removed test has an equivalent on head, with the same or stricter assertions.

Look here:

• cli_config_fallback.rs:165: the folded provenance loop over the (json, debug) pairs.
• scan/hosted_dryrun_vendored.rs:17:`` the shared hosted_pins, `hosted_skipped` and `warning_detail` replace the private helpers.
• scan/main.rs: the module mounts.
• scripts/ci-test-durations.json: two entries removed, and their times added to the binaries that received the tests.

Verified:

• Read the full diff and mapped each removed test to its new home. Nothing was dropped. CHANGELOG.md is untouched.
• Ran locally on head:
  • --test cli_config_fallback: 11 passed.
  • --test scan: 245 passed, in parallel with #[serial] removed, and with 0 warnings.
• The moved tests don't touch process env or cwd, so dropping #[serial] is safe.
• CI: ci-ok and clippy are green on this head. Cursor Bugbot: neutral, with no unresolved threads.

Changes I made: none.

Open questions (non-blocking nits):

• Commit 898d131 says prebuilt_common is now mounted once in the scan suite. It is actually mounted twice: once at the crate root, and again through vlt_hosted_common/vendored.rs. Its selftests run twice.
• The (false, false) loop case repeats the human, debug-off run made just above it. That costs one extra subprocess.

Auto-merge (squash) is armed, so approving sends this straight to the merge queue.

---

Generated by Claude Code