Repository navigation
fix: stop CI test/security jobs failing for reasons unrelated to code - #10
Merged
Merged
Conversation
added 2 commits
August 19, 2026 17:26
- tests/conftest.py: add an autouse fixture that guarantees a dummy OPENAI_API_KEY/ANTHROPIC_API_KEY are present during tests. Several unit tests construct a real OpenAIClient/AnthropicClient without injecting a mock client (they only check the returned type), which makes the real SDK constructor validate for *some* credential. That made 4 tests non-deterministic: they only passed if the ambient environment happened to have OPENAI_API_KEY set, which it doesn't in CI. The fixture falls back to a placeholder only when a real key isn't already set, so it never overrides an intentionally-configured key and never triggers a real network call on its own. - .github/workflows/ci.yml: skip the Snyk security-scan step instead of failing when SNYK_TOKEN isn't available. GitHub withholds regular Actions secrets from Dependabot-triggered workflow runs (a separate "Dependabot secrets" store is used for those), so the `security` job was failing on every dependency-bump PR for reasons that have nothing to do with the change being scanned. To get real scanning on Dependabot PRs too, add SNYK_TOKEN under Settings > Secrets and variables > Dependabot as well. Verified locally: ruff, mypy, and the full pytest suite (148 passed, 2 skipped) all pass with OPENAI_API_KEY/ANTHROPIC_API_KEY unset, matching the CI environment.
GitHub Actions doesn't allow the secrets context inside if: expressions (only env/with) — that made the whole workflow file fail to parse, so the CI push run failed instantly with 0 jobs created. actionlint caught it. Moved SNYK_TOKEN into the security job's env: block and gate on env.SNYK_TOKEN instead, which is allowed in if:. Verified with actionlint against all workflow files (clean).
3 of 4 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Two independent, unrelated CI failures, both root-caused and fixed:
1.
test (3.11)/test (3.12)— non-deterministic OpenAI-client teststests/unit/test_core.py::test_get_openai_client,test_core_extended.py::test_openai_prefix, and two tests intest_factory.pyconstruct a realOpenAIClientwithout injecting a mockclient(they only assert the returned type/model). That means the realopenaiSDK constructor runs, which validates that some credential is present — so these tests only ever passed ifOPENAI_API_KEYhappened to be set in the ambient environment, which it isn't in CI.Fix: an autouse
conftest.pyfixture that guaranteesOPENAI_API_KEY/ANTHROPIC_API_KEYare set for the duration of each test, falling back to a harmless placeholder only when a real key isn't already present. Never overrides an intentionally-configured key, never makes a real network call on its own.2.
security— Snyk step failing with401 UnauthorizedSNYK_TOKENis configured as a repo secret, but GitHub withholds regular Actions secrets from workflow runs triggered by Dependabot (there's a separate "Dependabot secrets" store for that). So thesecurityjob fails on every dependency-bump PR for reasons that have nothing to do with the change being scanned.Fix:
if: ${{ secrets.SNYK_TOKEN != '' }}on the Snyk step so it skips cleanly instead of failing red when the token isn't available. Real scanning still runs normally on regular PRs/pushes tomainwhere the secret is available. (To get real scanning on Dependabot PRs too, add the same token under Settings > Secrets and variables > Dependabot.)Test plan
ruff check src tests— cleanmypy src— cleanpytest tests --cov=src/prompt_optimizer— 148 passed, 2 skipped, 0 failed (run locally withOPENAI_API_KEY/ANTHROPIC_API_KEYunset, matching CI)🤖 Generated with Claude Code
https://claude.ai/code/session_01D1NqmG98y1XiSRBYk4SXoU