test(install): WOR-274 — chain worthless lock through post-install Docker e2e

[oblangatas]

Fresh-box install now proves worthless lock works end-to-end, not just --version.

TL;DR: Closes the WOR-235 AC gap by chaining install → lock → proxy → fake upstream on a bare-Ubuntu container, asserting the reconstructed real key arrives upstream.

Summary

The existing install-docker.yml job proves a non-Python Linux box can run curl|sh and end up with a worthless --version that prints. That's the floor of the AC for WOR-235, not the ceiling — users install worthless to lock keys, and nothing on CI covered that post-install. If the published worthless==0.3.0 wheel regressed the lock lifecycle, we'd ship it.

This chains the real feature on top of the existing install image:

1. Bare-Ubuntu → curl|sh (unchanged invariant: no python/pipx/uv pre-installed).
2. Write a fake OpenAI key to .env, run worthless lock --env .env — shard-A stays in .env, shard-B lands in the DB.
3. Start worthless up in-container, send a request with shard-A as Bearer to the proxy's /<alias>/v1/chat/completions.
4. Assert mock-upstream captured a request where Authorization: Bearer <real_key> — proving reconstruction from shard-A + shard-B actually happened.

What

• tests/install_fixtures/Dockerfile.ubuntu-bare-lock-e2e — extends the bare-Ubuntu baseline, runs install.sh at build time, then layers python3 after install so the fresh-box invariant still holds during the AC check. Entrypoint is the orchestrator.
• tests/install_fixtures/docker-compose.lock-e2e.yml — wires the installed container to mock-upstream on a private bridge; passes WORTHLESS_UPSTREAM_OPENAI_URL so the proxy talks to the fake instead of api.openai.com.
• tests/install_fixtures/lock_e2e.py — stdlib-only orchestration. Runs inside the worthless-installed container, drives the whole chain, exits non-zero with a clear message on any step that regresses.
• tests/test_install_docker.py — new test_bare_ubuntu_lock_lifecycle_end_to_end (marker=docker). Uses docker compose up --abort-on-container-exit --exit-code-from, captures logs for diagnosis, always tears down.
• .dockerignore — whitelist tests/install_fixtures/ so the Dockerfile can COPY lock_e2e.py without leaking the rest of tests/ into the production image.

Why

The WOR-235 AC says "fresh machine → working install → worthless lock works". Before this PR we proved (1) and (2). Missing (3) meant a broken wheel on PyPI would ship silently — the worthless --version happy path says nothing about whether shard splitting, the proxy, or format-preserving reconstruction still work against a real-ish provider. Reuses the existing tests/openclaw/mock-upstream fake instead of building another one.

How

• Built a new compose stack + Dockerfile pair so the baseline Dockerfile.ubuntu-bare stays minimal and the lock-e2e image can layer on orchestration tooling without weakening the fresh-box guard.
• Orchestrator is pure stdlib — no pip install inside the image, so build time stays bounded by install.sh itself.
• Compose tears down via docker compose down -v --remove-orphans in a finally block regardless of test outcome or timeout.
• The install-docker workflow already triggers on tests/install_fixtures/**, so this runs automatically on every installer-touching PR.
• Local wall time: ~2 min uncached, ~10s hot. Well under the <3 min additional runtime the ticket allowed.

Test plan

• uv run pytest -m docker tests/test_install_docker.py (both tests) — 2 passed
• uv run pytest tests/test_install_static.py tests/test_install_shellcheck.py tests/test_install_logic.py — 21 passed, 1 skipped
• uv run ruff check / uv run ruff format --check clean on new files
• Pre-commit hooks pass (ruff, codespell, bandit, gitleaks, etc.)
• CI install-docker.yml green on this PR

🤖 Generated with Claude Code

Summary by CodeRabbit

• Tests

  • Added comprehensive end-to-end tests validating lock behavior with mock upstream infrastructure, verifying key handling and proxy functionality.

• Chores

  • Updated Docker build and Compose configurations to support end-to-end test fixtures.

[coderabbitai]

📝 Walkthrough

Walkthrough

This PR adds end-to-end testing infrastructure for the lock lifecycle feature by introducing Docker-based fixtures and orchestration scripts that validate key splitting and reconstruction between worthless lock and worthless up with a mock upstream service.

Changes

Cohort / File(s)	Summary
Docker Configuration .dockerignore, tests/install_fixtures/Dockerfile.ubuntu-bare-lock-e2e, tests/install_fixtures/docker-compose.lock-e2e.yml	Added Docker Compose e2e test fixture with Ubuntu bare-metal Dockerfile that installs minimal dependencies, runs install.sh, and executes the lock e2e test harness. Also configured .dockerignore to include test fixtures during Docker builds.
E2E Test Orchestration tests/install_fixtures/lock_e2e.py	New post-install orchestration script that validates lock behavior by writing a fake API key, running worthless lock --env to split the key, starting worthless up as a background proxy, sending a request with a shard, and asserting the mock upstream receives the reconstructed original key.
Test Module tests/test_install_docker.py	Extended test suite with new end-to-end test test_bare_ubuntu_lock_lifecycle_end_to_end that launches the Docker Compose stack, validates successful exit, and ensures stack teardown.

Sequence Diagram

sequenceDiagram
    actor TestRunner as Test Runner
    participant Compose as Docker Compose
    participant WorthlessImg as worthless-installed
    participant MockUp as mock-upstream
    
    TestRunner->>Compose: docker compose up --build
    Compose->>MockUp: Start mock-upstream service
    MockUp->>MockUp: Health check polling
    Compose->>WorthlessImg: Start worthless-installed (depends_on healthy)
    WorthlessImg->>WorthlessImg: Run install.sh
    WorthlessImg->>WorthlessImg: Execute lock_e2e.py
    WorthlessImg->>WorthlessImg: Write fake OpenAI key to .env
    WorthlessImg->>WorthlessImg: Run worthless lock --env (splits key)
    WorthlessImg->>WorthlessImg: Start worthless up (background)
    WorthlessImg->>WorthlessImg: Poll proxy health until ready
    WorthlessImg->>WorthlessImg: Clear mock upstream captured headers
    WorthlessImg->>MockUp: POST /alias/v1/chat/completions with shard_a
    MockUp->>MockUp: Capture Authorization header
    WorthlessImg->>MockUp: GET /captured headers
    MockUp-->>WorthlessImg: Return captured requests with reconstructed key
    WorthlessImg->>WorthlessImg: Assert original key matches upstream Authorization
    WorthlessImg->>WorthlessImg: Terminate worthless up
    Compose-->>TestRunner: Exit code 0
    TestRunner->>Compose: docker compose down -v

Loading

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Possibly related PRs

• feat: OpenClaw integration test (WOR-213) #53: Both PRs integrate Docker Compose–based end-to-end testing with a mock upstream service; this PR's fixtures set the WORTHLESS_UPSTREAM_OPENAI_URL environment variable to configure the adapter for proxying to the mock service, creating a direct workflow dependency.

Poem

🐰 A lock that splits, a proxy that mends,
Keys shattered, then whole again—
Docker builds test the dance divine,
From shard to secret, endpoint to mine! 🔑

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 37.50% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title directly and specifically describes the main change: adding a Docker e2e test that chains the lock workflow through post-install, matching the PR's core objective of verifying lock lifecycle after install.sh.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch shacharm/wor-274-install-lock-e2e

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

🧹 Nitpick comments (1)

tests/install_fixtures/lock_e2e.py (1)

101-108: Preserve worthless up logs for e2e failures.

Discarding stdout/stderr makes proxy startup and routing failures opaque even though the pytest wrapper dumps compose logs. Let the child inherit the container streams, or redirect to a temp file and print it on failure.

Suggested log preservation

     proxy = subprocess.Popen(  # noqa: S603, S607
         ["worthless", "up"],  # noqa: S607
-        stdout=subprocess.DEVNULL,
-        stderr=subprocess.DEVNULL,
     )

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@tests/install_fixtures/lock_e2e.py` around lines 101 - 108, The proxy
subprocess is started with stdout/stderr discarded which hides useful startup
logs; update the subprocess.Popen call that creates proxy (the call currently
assigned to variable proxy) to either inherit the parent's stdout/stderr (so
logs appear in the test output) or redirect both streams to a temporary file,
and then when wait_until_healthy(PROXY_HEALTH_URL) fails call fail("proxy did
not become healthy within 30s") only after dumping/printing the saved logs;
ensure the cleanup still closes the temp file or terminates proxy as needed so
logs are available for the pytest failure report.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Nitpick comments:
In `@tests/install_fixtures/lock_e2e.py`:
- Around line 101-108: The proxy subprocess is started with stdout/stderr
discarded which hides useful startup logs; update the subprocess.Popen call that
creates proxy (the call currently assigned to variable proxy) to either inherit
the parent's stdout/stderr (so logs appear in the test output) or redirect both
streams to a temporary file, and then when wait_until_healthy(PROXY_HEALTH_URL)
fails call fail("proxy did not become healthy within 30s") only after
dumping/printing the saved logs; ensure the cleanup still closes the temp file
or terminates proxy as needed so logs are available for the pytest failure
report.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 69fa4a49-1a68-4c0d-9963-7fd48ec63586

📥 Commits

Reviewing files that changed from the base of the PR and between d409a23 and 1e77a77.

📒 Files selected for processing (5)

• .dockerignore
• tests/install_fixtures/Dockerfile.ubuntu-bare-lock-e2e
• tests/install_fixtures/docker-compose.lock-e2e.yml
• tests/install_fixtures/lock_e2e.py
• tests/test_install_docker.py