CI: hermetic spawns in vendor build tests (#823)

crates/socket-patch-cli/tests/e2e_vendor_bun_build.rs

@@ -76,7 +76,7 @@
 
 #[path = "common/mod.rs"]
 mod common;
-use common::{binary, git_sha256, parse_json_envelope};
+use common::{binary, git_sha256, hermetic_command, parse_json_envelope};
 
 #[path = "prebuilt_common/mod.rs"]
 mod prebuilt_common;
@@ -279,12 +279,13 @@ fn bun(cwd: &Path, args: &[&str], cache_dir: &Path) -> Output {
     cmd.output().expect("failed to run bun")
 }
 
-/// The real binary with `--no-telemetry` appended: nothing in this suite
-/// should ever post a telemetry event, mocked API or not.
+/// The real binary in the hermetic environment (`tests/common/hermetic.rs`)
+/// plus the bun tool scrub, with `--no-telemetry` appended: nothing in this
+/// suite should ever post a telemetry event, mocked API or not.
 fn run_socket(cwd: &Path, args: &[&str]) -> (i32, String, String) {
-    let mut cmd = Command::new(binary());
+    let mut cmd = hermetic_command(&binary());
     cmd.current_dir(cwd);
-    cache_env::scrub_ambient_bun_env(&mut cmd);
+    cache_env::scrub_ambient_bun_tool_env(&mut cmd);
     let _fixture = prebuilt_common::prepare_command(&mut cmd, cwd, args, &[]);
     cmd.arg("--no-telemetry");
     let out = cmd.output().expect("failed to run socket-patch binary");

crates/socket-patch-cli/tests/e2e_vendor_cargo_build.rs

@@ -81,7 +81,7 @@
 
 #[path = "common/mod.rs"]
 mod common;
-use common::{binary, git_sha256, parse_json_envelope};
+use common::{binary, git_sha256, hermetic, hermetic_command, parse_json_envelope};
 
 #[path = "prebuilt_common/mod.rs"]
 mod prebuilt_common;
@@ -204,18 +204,13 @@ fn metadata_version(dir: &Path, cargo_home: &Path) -> String {
 
 // ── self-contained helpers ────────────────────────────────────────────
 
-/// Run socket-patch with ambient `SOCKET_*` vars scrubbed and the fixture's
-/// private CARGO_HOME injected (the cargo crawler resolves the registry
+/// Run socket-patch in the hermetic environment (`tests/common/hermetic.rs`)
+/// with the fixture's private CARGO_HOME injected (the cargo crawler resolves the registry
 /// source tree through it).
 fn run_socket(cwd: &Path, args: &[&str], cargo_home: &Path) -> (i32, String, String) {
-    let mut cmd = Command::new(binary());
+    let mut cmd = hermetic_command(&binary());
+    hermetic::scrub_extra(&mut cmd, &[hermetic::Extra::Venv]);
     cmd.current_dir(cwd);
-    for (k, _) in std::env::vars_os() {
-        if k.to_string_lossy().starts_with("SOCKET_") && k.to_string_lossy() != "SOCKET_NO_CONFIG" {
-            cmd.env_remove(&k);
-        }
-    }
-    cmd.env_remove("VIRTUAL_ENV");
     cmd.env("CARGO_HOME", cargo_home);
     let _fixture = prebuilt_common::prepare_command(
         &mut cmd,

crates/socket-patch-cli/tests/e2e_vendor_composer_build.rs

@@ -60,13 +60,13 @@
 
 #[path = "common/mod.rs"]
 mod common;
-use common::{binary, git_sha256};
+use common::{binary, git_sha256, hermetic, hermetic_command};
 
 #[path = "prebuilt_common/mod.rs"]
 mod prebuilt_common;
 
 use std::path::{Path, PathBuf};
-use std::process::{Command, Output};
+use std::process::Output;
 
 use wiremock::matchers::{method, path, path_regex};
 use wiremock::{Mock, MockServer, ResponseTemplate};
@@ -96,18 +96,14 @@ const FIXTURE_VERSION: &str = "3.0.2";
 
 // ── self-contained helpers ────────────────────────────────────────────
 
-/// Run the socket-patch binary with a scrubbed environment: every ambient
-/// `SOCKET_*` var is removed (so a developer's `SOCKET_DRY_RUN=1` etc. can't
-/// flip behavior) along with `VIRTUAL_ENV` (crawler discovery input).
+/// Run the socket-patch binary in the hermetic environment
+/// (`tests/common/hermetic.rs`: no ambient `SOCKET_*`, so a developer's
+/// `SOCKET_DRY_RUN=1` etc. can't flip behavior) with `VIRTUAL_ENV` (crawler
+/// discovery input) removed.
 fn run_socket(cwd: &Path, args: &[&str]) -> (i32, String, String) {
-    let mut cmd = Command::new(binary());
+    let mut cmd = hermetic_command(&binary());
+    hermetic::scrub_extra(&mut cmd, &[hermetic::Extra::Venv]);
     cmd.current_dir(cwd);
-    for (k, _) in std::env::vars_os() {
-        if k.to_string_lossy().starts_with("SOCKET_") && k.to_string_lossy() != "SOCKET_NO_CONFIG" {
-            cmd.env_remove(&k);
-        }
-    }
-    cmd.env_remove("VIRTUAL_ENV");
     let _fixture = prebuilt_common::prepare_command(&mut cmd, cwd, args, &[]);
     let out = cmd.output().expect("failed to run socket-patch binary");
     (

crates/socket-patch-cli/tests/e2e_vendor_composer_crlf.rs

@@ -8,6 +8,8 @@
 //! the pre-vendor bytes exactly. Each test runs the built binary; the
 //! discovery/view routes are a wiremock API, so no composer and no network.
 
+#[path = "common/hermetic.rs"]
+mod hermetic;
 #[path = "prebuilt_common/mod.rs"]
 mod prebuilt_common;
 
@@ -168,16 +170,9 @@ async fn mount_api(server: &MockServer) {
         .await;
 }
 
+/// The built binary in the hermetic environment (`tests/common/hermetic.rs`).
 fn cli() -> Command {
-    let mut cmd = Command::new(env!("CARGO_BIN_EXE_socket-patch"));
-    for (key, _) in std::env::vars_os() {
-        let name = key.to_string_lossy();
-        if name.starts_with("SOCKET_") && name != "SOCKET_NO_CONFIG" {
-            cmd.env_remove(&key);
-        }
-    }
-    cmd.env("SOCKET_TELEMETRY_DISABLED", "1");
-    cmd
+    hermetic::binary_command()
 }
 
 fn run_json(root: &Path, args: &[&str]) -> (i32, Value) {

crates/socket-patch-cli/tests/e2e_vendor_gem_build.rs

@@ -60,7 +60,7 @@
 
 #[path = "common/mod.rs"]
 mod common;
-use common::{binary, git_sha256, parse_json_envelope};
+use common::{binary, git_sha256, hermetic, hermetic_command, parse_json_envelope};
 
 #[path = "prebuilt_common/mod.rs"]
 mod prebuilt_common;
@@ -102,18 +102,15 @@ fn argv(args: &[String]) -> Vec<&str> {
     args.iter().map(String::as_str).collect()
 }
 
-/// Run the socket-patch binary with a scrubbed environment: every ambient
-/// `SOCKET_*` var is removed (so a developer's `SOCKET_DRY_RUN=1` etc. can't
-/// flip behavior) along with `VIRTUAL_ENV` (crawler discovery input).
+/// Run the socket-patch binary in the hermetic environment
+/// (`tests/common/hermetic.rs`: no ambient `SOCKET_*`, so a developer's
+/// `SOCKET_DRY_RUN=1` etc. can't flip behavior) with `VIRTUAL_ENV` and every
+/// `BUNDLE_*` (crawler discovery inputs: an ambient `BUNDLE_PATH` or
+/// `BUNDLE_GEMFILE` would point the crawler away from the fixture) removed.
 fn run_socket(cwd: &Path, args: &[&str]) -> (i32, String, String) {
-    let mut cmd = Command::new(binary());
+    let mut cmd = hermetic_command(&binary());
+    hermetic::scrub_extra(&mut cmd, &[hermetic::Extra::Venv, hermetic::Extra::Bundle]);
     cmd.current_dir(cwd);
-    for (k, _) in std::env::vars_os() {
-        if k.to_string_lossy().starts_with("SOCKET_") && k.to_string_lossy() != "SOCKET_NO_CONFIG" {
-            cmd.env_remove(&k);
-        }
-    }
-    cmd.env_remove("VIRTUAL_ENV");
     let _fixture = prebuilt_common::prepare_command(&mut cmd, cwd, args, &[]);
     let out = cmd.output().expect("failed to run socket-patch binary");
     (

crates/socket-patch-cli/tests/e2e_vendor_golang_build.rs

@@ -28,7 +28,7 @@
 #[path = "common/mod.rs"]
 mod common;
 use common::envelope::find_event;
-use common::{binary, git_sha256, parse_json_envelope};
+use common::{binary, git_sha256, hermetic, hermetic_command, parse_json_envelope};
 
 #[path = "prebuilt_common/mod.rs"]
 mod prebuilt_common;
@@ -59,17 +59,13 @@ const PATCHED_LIB: &str = "package upstream\n\nfunc Greeting() string { return \
 
 // ── self-contained helpers ────────────────────────────────────────────
 
-/// Run socket-patch with `SOCKET_*` scrubbed + the fixture GOMODCACHE (the
-/// go crawler resolves installed modules through it).
+/// Run socket-patch in the hermetic environment (`tests/common/hermetic.rs`)
+/// with the fixture GOMODCACHE (the go crawler resolves installed modules
+/// through it).
 fn run_socket(cwd: &Path, args: &[&str], modcache: &Path) -> (i32, String, String) {
-    let mut cmd = Command::new(binary());
+    let mut cmd = hermetic_command(&binary());
+    hermetic::scrub_extra(&mut cmd, &[hermetic::Extra::Venv]);
     cmd.current_dir(cwd);
-    for (k, _) in std::env::vars_os() {
-        if k.to_string_lossy().starts_with("SOCKET_") && k.to_string_lossy() != "SOCKET_NO_CONFIG" {
-            cmd.env_remove(&k);
-        }
-    }
-    cmd.env_remove("VIRTUAL_ENV");
     cmd.env("GOMODCACHE", modcache);
     let _fixture = prebuilt_common::prepare_command(
         &mut cmd,

crates/socket-patch-cli/tests/e2e_vendor_jvm_build.rs

@@ -32,7 +32,7 @@
 
 #[path = "common/mod.rs"]
 mod common;
-use common::{binary, git_sha256};
+use common::{binary, git_sha256, hermetic, hermetic_command};
 
 #[path = "maven_build_common/mod.rs"]
 mod maven_build_common;
@@ -48,7 +48,7 @@ mod jvm_fixture_repo;
 
 use std::collections::BTreeMap;
 use std::path::{Path, PathBuf};
-use std::process::{Command, Output};
+use std::process::Output;
 
 use gradle_build_common::{
     assert_patched, configuration_reused, fixture_root, gradle_classpath, gradle_skip, init_script,
@@ -65,7 +65,7 @@ const SV: &str = "1.10.0-socket.1d3c1fd2";
 /// the local repository would break the plugin realm, not the project.
 const CLASSPATH_PLUGIN: &str = "org.apache.maven.plugins:maven-dependency-plugin:3.5.0";
 
-/// `socket-patch <args>` with ambient `SOCKET_*` scrubbed, `m2` as the Maven
+/// `socket-patch <args>` in the hermetic environment, `m2` as the Maven
 /// repo and, when given, `gradle_home` as the `GRADLE_USER_HOME` the CLI
 /// crawls (and the fixture registry serves).
 fn socket_in(
@@ -74,24 +74,17 @@ fn socket_in(
     gradle_home: Option<&Path>,
     args: &[&str],
 ) -> (Option<i32>, serde_json::Value, String) {
-    let mut cmd = Command::new(binary());
-    for (k, _) in std::env::vars_os() {
-        if k.to_string_lossy().starts_with("SOCKET_") {
-            cmd.env_remove(&k);
-        }
-    }
+    let mut cmd = hermetic_command(&binary());
+    hermetic::scrub_extra(&mut cmd, &[hermetic::Extra::Venv]);
     let mut caches = vec![("MAVEN_REPO_LOCAL", m2.to_str().unwrap())];
     if let Some(home) = gradle_home {
         caches.push(("GRADLE_USER_HOME", home.to_str().unwrap()));
     }
     let _fixture = prebuilt_common::prepare_command(&mut cmd, cwd, args, &caches);
     let out = cmd
         .current_dir(cwd)
-        .env("SOCKET_TELEMETRY_DISABLED", "1")
-        .env("SOCKET_NO_CONFIG", "1")
         .env("MAVEN_REPO_LOCAL", m2)
         .env_remove("M2_HOME")
-        .env_remove("VIRTUAL_ENV")
         .output()
         .expect("run socket-patch");
     let stdout = String::from_utf8_lossy(&out.stdout).into_owned();

crates/socket-patch-cli/tests/e2e_vendor_maven_build.rs

@@ -51,7 +51,6 @@ mod prebuilt_common;
 mod vex_e2e_common;
 
 use std::path::{Path, PathBuf};
-use std::process::Command;
 
 use maven_build_common::*;
 use vex_e2e_common::*;
@@ -95,15 +94,11 @@ fn snapshot(dir: &Path) -> std::collections::BTreeMap<String, Vec<u8>> {
     out
 }
 
-/// `socket-patch <args>` with ambient `SOCKET_*` scrubbed and the per-test
+/// `socket-patch <args>` in the hermetic environment and the per-test
 /// local repository as the crawler's maven repo.
 fn socket(cwd: &Path, m2: &Path, args: &[&str]) -> (Option<i32>, serde_json::Value, String) {
-    let mut cmd = Command::new(binary());
-    for (k, _) in std::env::vars_os() {
-        if k.to_string_lossy().starts_with("SOCKET_") {
-            cmd.env_remove(&k);
-        }
-    }
+    let mut cmd = hermetic::command(&binary());
+    hermetic::scrub_extra(&mut cmd, &[hermetic::Extra::Venv]);
     let _fixture = prebuilt_common::prepare_command(
         &mut cmd,
         cwd,
@@ -112,11 +107,8 @@ fn socket(cwd: &Path, m2: &Path, args: &[&str]) -> (Option<i32>, serde_json::Val
     );
     let out = cmd
         .current_dir(cwd)
-        .env("SOCKET_TELEMETRY_DISABLED", "1")
-        .env("SOCKET_NO_CONFIG", "1")
         .env("MAVEN_REPO_LOCAL", m2)
         .env_remove("M2_HOME")
-        .env_remove("VIRTUAL_ENV")
         .output()
         .expect("run socket-patch");
     let stdout = String::from_utf8_lossy(&out.stdout).into_owned();

crates/socket-patch-cli/tests/e2e_vendor_npm_build.rs

@@ -37,7 +37,7 @@
 
 #[path = "common/mod.rs"]
 mod common;
-use common::{binary, git_sha256};
+use common::{binary, git_sha256, hermetic, hermetic_command};
 
 #[path = "prebuilt_common/mod.rs"]
 mod prebuilt_common;
@@ -68,18 +68,14 @@ const ORG: &str = "test-org";
 
 // ── self-contained helpers ────────────────────────────────────────────
 
-/// Run the socket-patch binary with a scrubbed environment: every ambient
-/// `SOCKET_*` var is removed (so a developer's `SOCKET_DRY_RUN=1` etc. can't
-/// flip behavior) along with `VIRTUAL_ENV` (crawler discovery input).
+/// Run the socket-patch binary in the hermetic environment
+/// (`tests/common/hermetic.rs`: no ambient `SOCKET_*`, so a developer's
+/// `SOCKET_DRY_RUN=1` etc. can't flip behavior) with `VIRTUAL_ENV` (crawler
+/// discovery input) removed.
 fn run_socket(cwd: &Path, args: &[&str]) -> (i32, String, String) {
-    let mut cmd = Command::new(binary());
+    let mut cmd = hermetic_command(&binary());
+    hermetic::scrub_extra(&mut cmd, &[hermetic::Extra::Venv]);
     cmd.current_dir(cwd);
-    for (k, _) in std::env::vars_os() {
-        if k.to_string_lossy().starts_with("SOCKET_") && k.to_string_lossy() != "SOCKET_NO_CONFIG" {
-            cmd.env_remove(&k);
-        }
-    }
-    cmd.env_remove("VIRTUAL_ENV");
     let _fixture = prebuilt_common::prepare_command(&mut cmd, cwd, args, &[]);
     let out = cmd.output().expect("failed to run socket-patch binary");
     (

crates/socket-patch-cli/tests/e2e_vendor_pypi_build.rs

@@ -56,7 +56,7 @@
 
 #[path = "common/mod.rs"]
 mod common;
-use common::{binary, git_sha256};
+use common::{binary, git_sha256, hermetic, hermetic_command};
 
 #[path = "prebuilt_common/mod.rs"]
 mod prebuilt_common;
@@ -113,18 +113,14 @@ const ORACLE: &str = "import six; print(six.SOCKET_PATCHED)";
 
 // ── self-contained helpers ────────────────────────────────────────────
 
-/// Run socket-patch with ambient `SOCKET_*` + `VIRTUAL_ENV` scrubbed
-/// (`VIRTUAL_ENV` is a python-crawler discovery input and must not leak from
-/// the developer's shell).
+/// Run socket-patch in the hermetic environment (`tests/common/hermetic.rs`)
+/// with `VIRTUAL_ENV` and `UV_PROJECT_ENVIRONMENT` removed: both are
+/// python-crawler discovery inputs that must not leak from the developer's
+/// shell, and `bake_leak_guards` sets the latter in this process.
 fn run_socket(cwd: &Path, args: &[&str]) -> (i32, String, String) {
-    let mut cmd = Command::new(binary());
+    let mut cmd = hermetic_command(&binary());
+    hermetic::scrub_extra(&mut cmd, &[hermetic::Extra::Venv, hermetic::Extra::Pdm]);
     cmd.current_dir(cwd);
-    for (k, _) in std::env::vars_os() {
-        if k.to_string_lossy().starts_with("SOCKET_") && k.to_string_lossy() != "SOCKET_NO_CONFIG" {
-            cmd.env_remove(&k);
-        }
-    }
-    cmd.env_remove("VIRTUAL_ENV");
     let _fixture = prebuilt_common::prepare_command(&mut cmd, cwd, args, &[]);
     let out = cmd.output().expect("failed to run socket-patch binary");
     (

crates/socket-patch-cli/tests/spawn_env_hygiene.rs

@@ -48,16 +48,6 @@ const PENDING_RAW_SPAWNS: &[&str] = &[
     "e2e_redirect_cargo_shapes.rs",
     "e2e_scan.rs",
     "e2e_socket_yml_policy.rs",
-    "e2e_vendor_bun_build.rs",
-    "e2e_vendor_cargo_build.rs",
-    "e2e_vendor_composer_build.rs",
-    "e2e_vendor_composer_crlf.rs",
-    "e2e_vendor_gem_build.rs",
-    "e2e_vendor_golang_build.rs",
-    "e2e_vendor_jvm_build.rs",
-    "e2e_vendor_maven_build.rs",
-    "e2e_vendor_npm_build.rs",
-    "e2e_vendor_pypi_build.rs",
     "e2e_vendored_production.rs",
     "e2e_vex_vendor.rs",
     "rollback/rollback_multicopy_blob_gate.rs",

crates/socket-patch-core/src/patch/redirect/upstream/npm.rs

@@ -4024,7 +4024,10 @@ mod tests {
         );
     }
 
+    // The `from_project: false` fallback reads `SOCKET_NPM_REGISTRY`, which
+    // serial tests (bun_lockb, vlt) set to a wiremock URL.
     #[test]
+    #[serial_test::serial]
     fn project_registry_decides_a_mirrors_tarball_urls() {
         // A metadata mirror that hands back the project registry's own URLs:
         // the package manager derives them, so they stay out of the lock.