test: cover commit truncation, exit code remap, and Buildkite formatting

Adds and updates unit tests for the v2.3.0 behavior changes:

tests/unit/test_cli_config.py
- Commit message under 200 chars passes through unchanged
- Commit message over 200 chars truncated to exactly 200
- Quote-strip runs BEFORE truncation (250-char inner -> 200)
- --exit-code-on-api-error defaults to 3
- --exit-code-on-api-error accepts custom and zero values

tests/unit/test_socketcli.py
- APIFailure -> exit 3 by default
- APIFailure -> exit 3 EVEN with --disable-blocking (breaking change for
  2.3.0: --disable-blocking only affects security findings now)
- RequestTimeoutExceeded -> exit 3 by default
- --exit-code-on-api-error 100 remaps timeout to exit 100
- --exit-code-on-api-error 0 swallows infrastructure errors
- Generic RuntimeError uses exit_code_on_api_error too
- _emit_infrastructure_error:
  * BUILDKITE=true emits "^^^ +++" and "--- ⚠️" markers (stdout)
    plus a soft_fail hint (logger)
  * Without BUILDKITE, no markers and no soft_fail hint
  * Traceback only included when include_traceback=True

Replaces the old test_cli_honors_disable_blocking_for_api_failures test
which encoded the pre-2.3.0 coupling between --disable-blocking and infra
errors -- that coupling is gone by design.

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

Author: lelia

tests/unit/test_cli_config.py

@@ -90,6 +90,42 @@ def test_api_request_timeout_defaults_to_twenty_minutes(self):
         config = CliConfig.from_args(["--api-token", "test"])
         assert socketcli.get_api_request_timeout(config) == 1200
 
+    def test_commit_message_passes_through_under_limit(self):
+        msg = "short commit message"
+        config = CliConfig.from_args(["--api-token", "test", "--commit-message", msg])
+        assert config.commit_message == msg
+
+    def test_commit_message_truncated_above_limit(self):
+        # 250 chars -> must truncate to 200
+        msg = "a" * 250
+        config = CliConfig.from_args(["--api-token", "test", "--commit-message", msg])
+        assert config.commit_message is not None
+        assert len(config.commit_message) == 200
+        assert config.commit_message == "a" * 200
+
+    def test_commit_message_quote_strip_runs_before_truncation(self):
+        # Quoted message of 250 inner chars -> quote-stripped, then truncated to 200.
+        inner = "b" * 250
+        quoted = f'"{inner}"'
+        config = CliConfig.from_args(["--api-token", "test", "--commit-message", quoted])
+        assert config.commit_message == "b" * 200
+
+    def test_exit_code_on_api_error_default_is_3(self):
+        config = CliConfig.from_args(["--api-token", "test"])
+        assert config.exit_code_on_api_error == 3
+
+    def test_exit_code_on_api_error_accepts_custom_value(self):
+        config = CliConfig.from_args(
+            ["--api-token", "test", "--exit-code-on-api-error", "100"]
+        )
+        assert config.exit_code_on_api_error == 100
+
+    def test_exit_code_on_api_error_accepts_zero(self):
+        config = CliConfig.from_args(
+            ["--api-token", "test", "--exit-code-on-api-error", "0"]
+        )
+        assert config.exit_code_on_api_error == 0
+
     def test_socket_sdk_receives_cli_timeout(self, monkeypatch):
         captured = {}
 

tests/unit/test_socketcli.py

@@ -4,17 +4,84 @@
 from socketdev.exceptions import APIFailure
 
 from socketsecurity import socketcli
+from socketsecurity.core.exceptions import RequestTimeoutExceeded
 
 
-def test_cli_honors_disable_blocking_for_api_failures(monkeypatch):
+# ---------------------------------------------------------------------------
+# Exit code semantics (spec v2.3.0): infrastructure errors map to
+# config.exit_code_on_api_error (default 3), INDEPENDENT of --disable-blocking.
+# ---------------------------------------------------------------------------
+
+
+def test_api_failure_exits_with_default_exit_code_on_api_error(monkeypatch):
+    def fail_main_code():
+        raise APIFailure("upstream request timeout")
+
+    monkeypatch.setattr(socketcli, "main_code", fail_main_code)
+    monkeypatch.setattr(sys, "argv", ["socketcli", "--api-token", "test"])
+
+    with pytest.raises(SystemExit) as exc_info:
+        socketcli.cli()
+
+    assert exc_info.value.code == 3
+
+
+def test_api_failure_exits_3_even_with_disable_blocking(monkeypatch):
+    # Breaking change for 2.3.0: --disable-blocking no longer zeroes out
+    # infrastructure errors. Use --exit-code-on-api-error 0 for that.
     def fail_main_code():
         raise APIFailure("upstream request timeout")
 
+    monkeypatch.setattr(socketcli, "main_code", fail_main_code)
+    monkeypatch.setattr(
+        sys, "argv", ["socketcli", "--api-token", "test", "--disable-blocking"]
+    )
+
+    with pytest.raises(SystemExit) as exc_info:
+        socketcli.cli()
+
+    assert exc_info.value.code == 3
+
+
+def test_request_timeout_exceeded_exits_with_configured_code(monkeypatch):
+    def fail_main_code():
+        raise RequestTimeoutExceeded("scan diff timed out after 1200s")
+
+    monkeypatch.setattr(socketcli, "main_code", fail_main_code)
+    monkeypatch.setattr(sys, "argv", ["socketcli", "--api-token", "test"])
+
+    with pytest.raises(SystemExit) as exc_info:
+        socketcli.cli()
+
+    assert exc_info.value.code == 3
+
+
+def test_exit_code_on_api_error_remaps_timeout(monkeypatch):
+    def fail_main_code():
+        raise RequestTimeoutExceeded("scan diff timed out after 1200s")
+
     monkeypatch.setattr(socketcli, "main_code", fail_main_code)
     monkeypatch.setattr(
         sys,
         "argv",
-        ["socketcli", "--api-token", "test", "--disable-blocking"],
+        ["socketcli", "--api-token", "test", "--exit-code-on-api-error", "100"],
+    )
+
+    with pytest.raises(SystemExit) as exc_info:
+        socketcli.cli()
+
+    assert exc_info.value.code == 100
+
+
+def test_exit_code_on_api_error_zero_swallows_infrastructure_errors(monkeypatch):
+    def fail_main_code():
+        raise RequestTimeoutExceeded("scan diff timed out after 1200s")
+
+    monkeypatch.setattr(socketcli, "main_code", fail_main_code)
+    monkeypatch.setattr(
+        sys,
+        "argv",
+        ["socketcli", "--api-token", "test", "--exit-code-on-api-error", "0"],
     )
 
     with pytest.raises(SystemExit) as exc_info:
@@ -23,14 +90,79 @@ def fail_main_code():
     assert exc_info.value.code == 0
 
 
-def test_cli_returns_error_for_api_failures_without_disable_blocking(monkeypatch):
+def test_generic_exception_uses_exit_code_on_api_error(monkeypatch):
     def fail_main_code():
-        raise APIFailure("upstream request timeout")
+        raise RuntimeError("unexpected boom")
 
     monkeypatch.setattr(socketcli, "main_code", fail_main_code)
-    monkeypatch.setattr(sys, "argv", ["socketcli", "--api-token", "test"])
+    monkeypatch.setattr(
+        sys,
+        "argv",
+        ["socketcli", "--api-token", "test", "--exit-code-on-api-error", "7"],
+    )
 
     with pytest.raises(SystemExit) as exc_info:
         socketcli.cli()
 
-    assert exc_info.value.code == 3
+    assert exc_info.value.code == 7
+
+
+# ---------------------------------------------------------------------------
+# Buildkite-aware log formatting (spec §3): ^^^ +++ / --- markers only
+# emitted when BUILDKITE=true; bare log.error otherwise.
+# ---------------------------------------------------------------------------
+
+
+def test_emit_infrastructure_error_no_buildkite_has_no_markers(
+    monkeypatch, capsys, caplog
+):
+    monkeypatch.setattr(socketcli, "IS_BUILDKITE", False)
+    with caplog.at_level("ERROR", logger="socketcli"):
+        socketcli._emit_infrastructure_error(
+            "something failed", hint="just so you know"
+        )
+    captured = capsys.readouterr()
+    assert "^^^ +++" not in captured.out
+    assert "--- :warning:" not in captured.out
+    log_text = "\n".join(r.getMessage() for r in caplog.records)
+    assert "soft_fail" not in log_text
+
+
+def test_emit_infrastructure_error_buildkite_emits_markers(
+    monkeypatch, capsys, caplog
+):
+    monkeypatch.setattr(socketcli, "IS_BUILDKITE", True)
+    with caplog.at_level("ERROR", logger="socketcli"):
+        socketcli._emit_infrastructure_error(
+            "something failed", hint="just so you know"
+        )
+    captured = capsys.readouterr()
+    # Markers go to stdout via print() so pytest's capsys catches them cleanly.
+    assert "^^^ +++" in captured.out
+    assert "--- :warning: Socket Infrastructure Error" in captured.out
+    # The soft_fail tip is appended via log.error() -- caplog captures it.
+    log_text = "\n".join(r.getMessage() for r in caplog.records)
+    assert "soft_fail" in log_text
+
+
+def test_emit_infrastructure_error_omits_traceback_by_default(monkeypatch, capsys):
+    monkeypatch.setattr(socketcli, "IS_BUILDKITE", False)
+    try:
+        raise ValueError("boom")
+    except ValueError:
+        socketcli._emit_infrastructure_error("wrapped", include_traceback=False)
+    captured = capsys.readouterr()
+    assert "Traceback" not in captured.err
+    assert "Traceback" not in captured.out
+
+
+def test_emit_infrastructure_error_includes_traceback_on_request(monkeypatch, capsys):
+    monkeypatch.setattr(socketcli, "IS_BUILDKITE", False)
+    try:
+        raise ValueError("boom")
+    except ValueError:
+        socketcli._emit_infrastructure_error("wrapped", include_traceback=True)
+    captured = capsys.readouterr()
+    # traceback.print_exc() writes to sys.stderr by default.
+    assert "Traceback" in captured.err
+    assert "ValueError: boom" in captured.err