Use tests/common's binary() and git_sha256 in CLI tests (#824)

[Mikola Lysenko (mikolalysenko)]

LLM Description written by Claude Code:claude-opus-5-5

Refs #824 (children 2 and 3, slice: the test files no open PR changes).

Summary

72 CLI test files kept a private fn binary() and/or fn git_sha256 that tests/common/mod.rs already provides. They now import common::binary / common::git_sha256. A one-sided ratchet in the cli test binary stops new copies.

Why

• Tracking issue #824, register row C30 (register), living document Part 8 (doc/08-tests-ci-docs.md) and summary item 16.
• Leverage: B 0 (test-only). U 1 (C31's binary merge and the rest of Tracking: share CLI test helpers through one test-support module instead of 100+ per-file copies #824 get smaller). D ≈ 100 copies: 52 binary() and 45 git_sha256 deleted. R L: no production code changes.
• Every other ranked candidate changes files that one of the 33 open PRs changes. This slice was the highest-leverage work inside the free files.

What changed

• 72 test files: deleted the private helpers and imported common's. Top-level files declare #[path = "common/mod.rs"] mod common;. Modules of directory binaries use crate::common::…. rollback/main.rs and e2e_vex_lockfile/main.rs now declare common.
• sha2::{Digest, Sha256} and PathBuf imports that only the deleted helpers used are gone.
• New tests/cli/shared_helper_copies.rs:
  • fails when a file outside tests/common defines its own binary() or git_sha256( and isn't on PENDING_PRIVATE_HELPERS;
  • stale entries don't fail, so a PR that migrates a pending file never turns another PR red;
  • a detector test covers every former copy shape (PathBuf and &'static str binaries, nested, pub, both git_sha256 parameter names) and the near misses (git_sha256_file, call sites, imports).

The former copies took five shapes. All of them return the same value as common's:

• binary() → env!("CARGO_BIN_EXE_socket-patch"), as a PathBuf or a &'static str. Every call site compiles unchanged against the PathBuf.
• git_sha256 → either the Git-blob framing written out (byte-identical to common's), or compute_git_sha256_from_bytes. Common's existing git_sha256_agrees_with_production_hash test pins the two as equal. That test runs in every binary that declares common, and so in every former caller.

Deleted

git diff --stat origin/main: 77 files, +451 / −584. Production lines changed: 0. Everything except the one-line ci.yml port below is test code.

• Migration: −583 / +≈270. The added lines are the mod common; and use lines.
• Guard: +≈180.

Left for later slices (listed in PENDING_PRIVATE_HELPERS)

• 68 files that open PRs change.
• The vlt_e2e_common, vlt_hosted_common and vlt_vendor_common modules. Some of the binaries that include them don't declare common yet, and those binaries' files are in open PRs.
• Spawn every CLI test child through one hermetic Command builder; 10 test files inherit ambient SOCKET_* today #823 (the scrub_socket_env copies) is untouched: its guard file spawn_env_hygiene.rs is changed by Remove --download-mode and the diff download path (#792) #1049.

CI port

This PR also carries #1118's one-line ci.yml fix: the label on the setup-php pin changes from # v2 to # 2.37.2. zizmor's Audit GitHub Actions check fails every new PR head on main's label until #1118 merges. The change does nothing once #1118 lands.

Behavior

None. No production code changed, and every test keeps its assertions.

Test evidence

• cargo test -p socket-patch-cli --all-features --no-run: every test target builds with no warnings in the touched files. The first build listed 71 unused-import warnings left behind by the deleted helpers; all were removed.
• cargo test -p socket-patch-cli --all-features --test spawn_env_hygiene: 12 passed. The first push failed it, because the guard's near-miss sample spelled out a bare binary spawn; the sample is now a plain binary() call.
• cargo test -p socket-patch-cli --all-features with --test for cli, rollback, remove, apply, scan, vendor, cli_apply_silent, cli_get_silent, cli_remove_silent, crawl_fd_limit_e2e, ecosystem_dispatch_e2e, in_process_rollback_all_ecosystems, maven_sidecar_cli, gradle_agent_cli, covgap_commands_vex, e2e_vex, e2e_vex_lockfile, coverage_fix_apply_silent_mute_exit, coverage_fix_vendor_silent_mute_exit and vendor_crash_safety_e2e: all pass (≈1,300 tests, 0 failed). The guard is included.
• CI on 2c7fffd: all 389 checks green, including coverage (the whole workspace's cargo test --tests), test-release, test (windows-latest) and the e2e matrices. Bugbot is clean.
• rustfmt --check: the touched files are clean, except for diffs that are already on main in e2e_redirect_yarn_classic_build.rs and e2e_vendor_yarn_berry_build.rs. Those were left alone.
• Clippy (--workspace --all-features -- -D warnings) doesn't build test targets, and no production file changed.

Risk

Low. The change is mechanical and test-only. The main risk is a merge conflict with PRs that later touch these test files' import blocks.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Nc6wa5b2SpVJQF9kDbquS6

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

BugBot review

---

Generated by Claude Code

[cursor]

Stale Bugbot comment from a previous run.

[Mikola Lysenko (mikolalysenko)]

BugBot review

---

Generated by Claude Code

[cursor]

Stale Bugbot comment from a previous run.

[Mikola Lysenko (mikolalysenko)]

BugBot review

---

Generated by Claude Code

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 2c7fffd. Configure here.}

[Mikola Lysenko (mikolalysenko)]

Ready for review (burn-down agent).

• Head: 2c7fffd2c1b41e2aed67e04cb8b5f45abc4cf3d4
• CI: 389/389 check runs green (success/skipped/neutral) on this head, mergeable, no conflicts.
• Bugbot: reviewed this head (Cursor Bugbot check: success), no unresolved review threads.
• Changelog: untouched.

Nothing specific flagged for the reviewer beyond the PR description.

---

Generated by Claude Code