CI: hermetic spawns in redirect build tests (#823)

crates/socket-patch-cli/tests/e2e_redirect_cargo_build.rs

@@ -68,10 +68,10 @@
 
 #[path = "common/mod.rs"]
 mod common;
-use common::binary;
+use common::{binary, hermetic, hermetic_command};
 
 use std::path::{Path, PathBuf};
-use std::process::{Command, Output};
+use std::process::Output;
 
 use sha2::{Digest, Sha256};
 use socket_patch_core::hash::git_sha256::compute_git_sha256_from_bytes;
@@ -107,18 +107,13 @@ const PATCH_SUFFIX: &str =
 
 // ── self-contained helpers ────────────────────────────────────────────
 
-/// Run socket-patch with ambient `SOCKET_*` vars scrubbed and the fixture's
-/// private CARGO_HOME injected (the cargo crawler resolves the registry
-/// source tree through it).
+/// Run socket-patch in the hermetic environment (`tests/common/hermetic.rs`)
+/// with the fixture's private CARGO_HOME injected (the cargo crawler
+/// resolves the registry source tree through it).
 fn run_socket(cwd: &Path, args: &[&str], cargo_home: &Path) -> (i32, String, String) {
-    let mut cmd = Command::new(binary());
+    let mut cmd = hermetic_command(&binary());
+    hermetic::scrub_extra(&mut cmd, &[hermetic::Extra::Venv]);
     cmd.args(args).current_dir(cwd);
-    for (k, _) in std::env::vars_os() {
-        if k.to_string_lossy().starts_with("SOCKET_") && k.to_string_lossy() != "SOCKET_NO_CONFIG" {
-            cmd.env_remove(&k);
-        }
-    }
-    cmd.env_remove("VIRTUAL_ENV");
     cmd.env("CARGO_HOME", cargo_home);
     let out = cmd.output().expect("failed to run socket-patch binary");
     (

crates/socket-patch-cli/tests/e2e_redirect_composer_build.rs

@@ -53,12 +53,13 @@
 //! release. `#[ignore]`-gated like the vendored twin: the unpinned `test` job
 //! skips it; the e2e job runs it with a pinned toolchain via `--ignored`.
 
+#[path = "common/hermetic.rs"]
+mod hermetic;
 #[path = "common/rollback_json.rs"]
 mod rollback_json;
 
 use std::io::Write as _;
 use std::path::{Path, PathBuf};
-use std::process::Command;
 
 use sha1::{Digest as _, Sha1};
 use wiremock::matchers::{method, path, path_regex};
@@ -304,19 +305,13 @@ fn lock_entry(proj: &Path, name: &str) -> serde_json::Value {
         .clone()
 }
 
-/// A socket-patch invocation with the ambient `SOCKET_*` surface scrubbed
-/// (telemetry off, no socket-cli config, `VIRTUAL_ENV` removed).
+/// A socket-patch invocation in the hermetic environment
+/// (`tests/common/hermetic.rs`: telemetry off, no socket-cli config) with
+/// `VIRTUAL_ENV` removed.
 fn run_socket(cwd: &Path, args: &[&str]) -> (i32, String, String) {
-    let mut cmd = Command::new(binary());
+    let mut cmd = hermetic::command(&binary());
+    hermetic::scrub_extra(&mut cmd, &[hermetic::Extra::Venv]);
     cmd.args(args).current_dir(cwd);
-    for (k, _) in std::env::vars_os() {
-        if k.to_string_lossy().starts_with("SOCKET_") {
-            cmd.env_remove(&k);
-        }
-    }
-    cmd.env("SOCKET_TELEMETRY_DISABLED", "1")
-        .env("SOCKET_NO_CONFIG", "1")
-        .env_remove("VIRTUAL_ENV");
     let out = cmd.output().expect("run socket-patch");
     (
         out.status.code().unwrap_or(-1),

crates/socket-patch-cli/tests/e2e_redirect_gem_build.rs

@@ -97,7 +97,7 @@
 
 #[path = "common/mod.rs"]
 mod common;
-use common::binary;
+use common::{binary, hermetic, hermetic_command};
 
 use std::io::Write as _;
 use std::path::{Path, PathBuf};
@@ -150,28 +150,20 @@ const TINY_LIB: &str = "module TinyDep\n  VALUE = \"tiny-ok\"\nend\n";
 
 // ── self-contained helpers ────────────────────────────────────────────
 
-/// Run the socket-patch binary with the ambient `SOCKET_*` surface scrubbed
-/// (a developer's `SOCKET_DRY_RUN=1` must not steer the assertions) and
-/// `VIRTUAL_ENV` (crawler discovery input) removed.
+/// Run the socket-patch binary in the hermetic environment
+/// (`tests/common/hermetic.rs`: a developer's `SOCKET_DRY_RUN=1` must not
+/// steer the assertions) with `VIRTUAL_ENV` (crawler discovery input) and
+/// every ambient `BUNDLE_*` var (the crawler reads `BUNDLE_GEMFILE`,
+/// `BUNDLE_PATH`, mirrors, ...) removed.
 fn run_socket(cwd: &Path, args: &[&str]) -> (i32, String, String) {
     run_socket_env(cwd, args, &[])
 }
 
 /// [`run_socket`] with extra environment on top of the scrubbed surface.
 fn run_socket_env(cwd: &Path, args: &[&str], envs: &[(&str, &str)]) -> (i32, String, String) {
-    let mut cmd = Command::new(binary());
+    let mut cmd = hermetic_command(&binary());
+    hermetic::scrub_extra(&mut cmd, &[hermetic::Extra::Venv, hermetic::Extra::Bundle]);
     cmd.args(args).current_dir(cwd);
-    for (k, _) in std::env::vars_os() {
-        if k.to_string_lossy().starts_with("SOCKET_") && k.to_string_lossy() != "SOCKET_NO_CONFIG" {
-            cmd.env_remove(&k);
-        }
-    }
-    for (key, _) in std::env::vars_os() {
-        if key.to_string_lossy().starts_with("BUNDLE_MIRROR__") {
-            cmd.env_remove(key);
-        }
-    }
-    cmd.env_remove("VIRTUAL_ENV");
     for (k, v) in envs {
         cmd.env(k, v);
     }

crates/socket-patch-cli/tests/e2e_redirect_maven_build.rs

@@ -52,6 +52,8 @@
 //! `SOCKET_PATCH_MAVEN_E2E_{MVN,VERSION,REQUIRED}` gates in
 //! `maven_build_common`.
 
+#[path = "common/hermetic.rs"]
+mod hermetic;
 #[path = "common/rollback_json.rs"]
 mod rollback_json;
 
@@ -63,7 +65,6 @@ mod maven_build_common;
 mod vex_e2e_common;
 
 use std::path::{Path, PathBuf};
-use std::process::Command;
 
 use hosted_maven_common::{Hosted, Server};
 use maven_build_common::*;
@@ -133,23 +134,17 @@ fn mount_api(s: &Server, jar: &[u8], pom: &[u8], view: &serde_json::Value) {
     hosted_maven_common::mount_api(s, &HOSTED, jar, pom, view);
 }
 
-/// `socket-patch <args>` with ambient `SOCKET_*` scrubbed and the per-test
-/// local repository as the crawler's maven repo.
+/// `socket-patch <args>` in the hermetic environment
+/// (`tests/common/hermetic.rs`) with the per-test local repository as the
+/// crawler's maven repo.
 fn socket(cwd: &Path, m2: &Path, args: &[&str]) -> (Option<i32>, serde_json::Value, String) {
-    let mut cmd = Command::new(binary());
-    for (k, _) in std::env::vars_os() {
-        if k.to_string_lossy().starts_with("SOCKET_") {
-            cmd.env_remove(&k);
-        }
-    }
+    let mut cmd = hermetic::command(&binary());
+    hermetic::scrub_extra(&mut cmd, &[hermetic::Extra::Venv]);
     let out = cmd
         .args(args)
         .current_dir(cwd)
-        .env("SOCKET_TELEMETRY_DISABLED", "1")
-        .env("SOCKET_NO_CONFIG", "1")
         .env("MAVEN_REPO_LOCAL", m2)
         .env_remove("M2_HOME")
-        .env_remove("VIRTUAL_ENV")
         .output()
         .expect("run socket-patch");
     let stdout = String::from_utf8_lossy(&out.stdout).into_owned();

crates/socket-patch-cli/tests/e2e_redirect_npm_build.rs

@@ -63,10 +63,10 @@ mod rollback_json;
 
 #[path = "common/mod.rs"]
 mod common;
-use common::binary;
+use common::{binary, hermetic, hermetic_command};
 
 use std::path::{Path, PathBuf};
-use std::process::{Command, Output};
+use std::process::Output;
 
 use sha2::{Digest, Sha512};
 use socket_patch_core::hash::git_sha256::compute_git_sha256_from_bytes;
@@ -107,18 +107,13 @@ const PURL_UNINSTALLED: &str = "pkg:npm/left-pad@9.9.9";
 
 // ── self-contained helpers ────────────────────────────────────────────
 
-/// Run the socket-patch binary with a scrubbed environment: every ambient
-/// `SOCKET_*` var is removed (so a developer's `SOCKET_DRY_RUN=1` etc. can't
-/// flip behavior) along with `VIRTUAL_ENV` (crawler discovery input).
+/// Run the socket-patch binary in the hermetic environment
+/// (`tests/common/hermetic.rs`: a developer's `SOCKET_DRY_RUN=1` etc. can't
+/// flip behavior) with `VIRTUAL_ENV` (crawler discovery input) removed.
 fn run_socket(cwd: &Path, args: &[&str]) -> (i32, String, String) {
-    let mut cmd = Command::new(binary());
+    let mut cmd = hermetic_command(&binary());
+    hermetic::scrub_extra(&mut cmd, &[hermetic::Extra::Venv]);
     cmd.args(args).current_dir(cwd);
-    for (k, _) in std::env::vars_os() {
-        if k.to_string_lossy().starts_with("SOCKET_") && k.to_string_lossy() != "SOCKET_NO_CONFIG" {
-            cmd.env_remove(&k);
-        }
-    }
-    cmd.env_remove("VIRTUAL_ENV");
     let out = cmd.output().expect("failed to run socket-patch binary");
     (
         out.status.code().unwrap_or(-1),

crates/socket-patch-cli/tests/spawn_env_hygiene.rs

@@ -46,12 +46,7 @@ const PENDING_RAW_SPAWNS: &[&str] = &[
     "e2e_pypi.rs",
     "e2e_pypi_multi_copy.rs",
     "e2e_redirect_bun_build.rs",
-    "e2e_redirect_cargo_build.rs",
     "e2e_redirect_cargo_shapes.rs",
-    "e2e_redirect_composer_build.rs",
-    "e2e_redirect_gem_build.rs",
-    "e2e_redirect_maven_build.rs",
-    "e2e_redirect_npm_build.rs",
     "e2e_scan.rs",
     "e2e_socket_yml_policy.rs",
     "e2e_vendor_bun_build.rs",