Fix tests

tests/test_cli.py

@@ -645,7 +645,9 @@ def test_cli_harvest_remote_sops_encrypts_and_prints_path(
     assert calls.get("encrypt")
 
 
-def test_cli_harvest_remote_password_required_exits_cleanly(monkeypatch):
+def test_cli_harvest_remote_password_required_exits_cleanly(
+    tmp_path: Path, monkeypatch
+):
     def boom(**kwargs):
         raise RemoteSudoPasswordRequired("pw required")
 
@@ -660,6 +662,8 @@ def test_cli_harvest_remote_password_required_exits_cleanly(monkeypatch):
             "example.com",
             "--remote-user",
             "root",
+            "--out",
+            str(tmp_path / "remote-harvest"),
         ],
     )
     with pytest.raises(SystemExit) as e:

tests/test_manifest.py

@@ -969,6 +969,10 @@ def test_manifest_fqdn_existing_output_rejects_symlink_component(tmp_path: Path)
     _write_state(bundle, state)
 
     (out / "inventory").mkdir(parents=True)
+    # The output path itself must be root-safe so this test reaches the
+    # intended nested-symlink guard even when CI/root uses a permissive umask.
+    out.chmod(0o700)
+    (out / "inventory").chmod(0o700)
     escape.mkdir()
     (out / "inventory" / "host_vars").symlink_to(escape, target_is_directory=True)
 

tests/test_manifest_safety.py

@@ -36,7 +36,11 @@ def test_prepare_manifest_output_dir_allows_existing_clean_tree_in_site_mode(
 ):
     out = tmp_path / "site"
     out.mkdir()
+    # Match Enroll's root-run output safety expectations regardless of the
+    # ambient CI/container umask.
+    out.chmod(0o700)
     (out / ".git").mkdir()
+    (out / ".git").chmod(0o700)
     (out / ".git" / "ignored-link").symlink_to(tmp_path, target_is_directory=True)
 
     assert prepare_manifest_output_dir(out, allow_existing=True) == out
@@ -45,6 +49,9 @@ def test_prepare_manifest_output_dir_allows_existing_clean_tree_in_site_mode(
 def test_prepare_manifest_output_dir_rejects_existing_tree_symlink(tmp_path: Path):
     out = tmp_path / "site"
     out.mkdir()
+    # Keep the root-safety check from masking the specific symlink assertion on
+    # Forgejo/Docker hosts that run with umask 0002.
+    out.chmod(0o700)
     (out / "bad-link").symlink_to(tmp_path, target_is_directory=True)
 
     with pytest.raises(ManifestOutputError, match="contains a symlink"):