CLI tests: verify sotto run overlays secrets onto the inherited environment

Open
  • Is something wrong?
#830 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
3/5
Estimated time
1-2 days
Newbie friendliness
62/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
rust
Domain
cli

Research direction

Start with run_with_entries in crates/cli/src/main.rs, which builds the child command and applies entries via Command::env, then read the existing subprocess tests near child_exit_status_helper to copy the isolation and bounded-wait pattern. Add helper-process tests that check inherited variables, same-name overrides, empty-string values, exact text round-trips, and that the override warning names the variable without its values. Done means the new tests pass on Unix and Windows and cargo fmt --all --check is clean.

Written by the indexing model from the issue text.

Description

good first issue help wanted test-coverage

The problem

sotto run overlays the selected environment's secrets onto the child process's inherited environment. The existing subprocess tests exercise exit-status propagation with an empty entries vector, so they do not protect the injection behaviour itself.

Add focused tests that observe the environment inside a real child process. This is a coverage gap, not a report that environment injection currently fails.

Evidence and starting points

Source-inspected on clean main at ee7ec8583dfe4e28ac08bbf456be2fb25fe8c359 on macOS:

  • run_with_entries creates a command, validates each key and applies entries through Command::env. It preserves the inherited environment and warns when a supplied name already exists.
  • Both the local-session and machine-token paths use this helper.
  • The subprocess tests show how to isolate the Unix process replacement / Windows process exit behaviour. child_exit_status_helper calls run_with_entries(Vec::new(), argv).

No Rust tests were executed for this issue. Existing CLI tests and open/closed issues were searched for overlap. #725 / PR #729 covered exit statuses; #803 / PR #805 document inheritance and shell quoting. This task verifies environment overlay through the actual launch path.

Acceptance criteria

  • Launch a helper process with a synthetic inherited variable that is not present in the injected entries; verify that the final child still receives it unchanged.
  • Seed another synthetic inherited variable and inject the same name with a different value. Verify that the final child receives the injected value.
  • Verify that an injected empty string replaces a non-empty inherited value and remains present as an empty variable, rather than being omitted.
  • Verify exact preservation of representative text values, including spaces, quotes, a newline, non-ASCII text and literal dollar-sign text. Use structured output or child-side assertions so shell interpolation and line splitting cannot hide a mismatch.
  • Assert that the override diagnostic identifies the overridden variable on stderr, without printing either its old or new value. Keep assertions focused on this diagnostic rather than requiring entirely empty stderr from the test harness.
  • Exercise run_with_entries itself, not a separately reconstructed Command. Run it only in an isolated helper process because it replaces or exits its process. Keep a bounded wait and clean up a timed-out child using the existing pattern.
  • Set inherited test variables on the helper's Command, not through process-wide environment mutation in the parallel test runner. Use dedicated synthetic variable names; do not override PATH, HOME or other system settings.

Scope and validation

No real vault, network access, machine token or OS keychain is required: pass synthetic entries directly at the shared launch boundary. Do not change injection policy or add a shell wrapper to production code.

Use platform-appropriate fixtures so the tests can run on supported Unix and Windows CI. Run the focused tests and cargo fmt --all --check, and report which platform was actually tested locally. Existing exit-status tests should continue to pass.

Follow CONTRIBUTING.md, including DCO sign-off (git commit -s).

Dominant language
Rust
Stars
31
Forks
42
Avg merge
2d 18h
Merged PRs (30d)
142

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from getsotto/sotto

All issues in getsotto/sotto

Similar issues

More Rust issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.