pybuilder-integration 106__tar.gz → 108__tar.gz

{pybuilder_integration-106 → pybuilder_integration-108}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pybuilder-integration
-Version: 106
+Version: 108
 Summary: A pybuilder plugin that runs integration tests (Tavern & Cypress) against a target.
 Home-page: https://github.com/rspitler/pybuilder-integration
 Author: 

{pybuilder_integration-106 → pybuilder_integration-108}/pybuilder_integration/tasks.py

@@ -1,9 +1,12 @@
+import atexit
+import errno
 import json
 import os
 import re
 import shutil
 import subprocess
 import tempfile
+import threading
 
 from defusedxml import ElementTree as ET
 from defusedxml.common import DefusedXmlException
@@ -124,15 +127,21 @@ def _run_verify_environment_passes_in_subprocesses(project: Project, logger: Log
             process, log_file = _start_verify_environment_subprocess(project, logger, pass_config, properties_file)
             processes.append((pass_config, process, log_file))
 
-        failures = []
+        results = []
         for pass_config, process, log_file in processes:
             exit_code = process.wait()
-            log_handle = getattr(process, "_pybuilder_integration_log_handle", None)
-            if log_handle:
-                log_handle.close()
-            if exit_code != 0:
-                failures.append(f"{pass_config['name']} exit_code={exit_code} log={log_file}")
-
+            _close_subprocess_log(process)
+            results.append({
+                "name": pass_config["name"],
+                "exit_code": exit_code,
+                "log_file": log_file,
+            })
+
+        _log_parallel_verify_environment_summary(logger, results)
+        failures = [
+            f"{result['name']} exit_code={result['exit_code']} log={result['log_file']}"
+            for result in results if result["exit_code"] != 0
+        ]
         if failures:
             raise BuildFailedException("Parallel verify_environment failed: " + "; ".join(failures))
     finally:
@@ -141,55 +150,623 @@ def _run_verify_environment_passes_in_subprocesses(project: Project, logger: Log
             if callable(poll) and poll() is None:
                 process.terminate()
                 process.wait()
-            log_handle = getattr(process, "_pybuilder_integration_log_handle", None)
-            if log_handle and not log_handle.closed:
-                log_handle.close()
+            _close_subprocess_log(process)
         _merge_parallel_verify_environment_outputs(project, passes)
+        _write_cypress_summary(project, logger)
         if os.path.exists(properties_file):
             os.remove(properties_file)
 
 
+_ANSI_ESCAPE = re.compile(r"\x1b\[[0-9;]*m")
+_SUITE_RUNNING_LINE = re.compile(
+    r"^\[INFO\]\s+Running (?!tavern tests\b|against target\b|cypress on host\b|args:).+"
+)
+_SECRET_QUOTE = r"(?:['\"]|"|')?"
+_SECRET_VALUE = rf"{_SECRET_QUOTE}[^'\"\s<&>,}}]+"
+_SECRET_LITERAL_VALUE = rf"(?!(?:true|false|yes|no|on|off|null|none)\b){_SECRET_VALUE}"
+_SECRET_KEY_NAME = (
+    r"(?:[A-Za-z][A-Za-z0-9]*[_-])*"
+    r"(?:"
+    r"x-api-key|x-amz-security-token|"
+    r"api[_-]?key|secret[_-]?access[_-]?key|access[_-]?key(?:[_-]?id)?|"
+    r"client[_-]?secret|password|secret|"
+    r"(?:id|access|refresh|session)?[_-]?token"
+    r")"
+)
+_SECRET_HINT_LINE = re.compile(
+    r"("
+    rf"\bauthorization\b{_SECRET_QUOTE}\s*:\s*{_SECRET_QUOTE}(?:(?:bearer|basic)\s+)?{_SECRET_VALUE}"
+    rf"|\b(?:set-cookie|cookie)\b{_SECRET_QUOTE}\s*:\s*{_SECRET_QUOTE}{_SECRET_VALUE}(?:\s*;\s*{_SECRET_VALUE})*"
+    rf"|{_SECRET_KEY_NAME}{_SECRET_QUOTE}\s*[:=]\s*{_SECRET_LITERAL_VALUE}"
+    r"|\bbearer\s+[A-Za-z0-9._\-]+"
+    r"|eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}(?:\.[A-Za-z0-9_-]{10,})?"
+    r"|https?://[^/\s]+:[^/\s]+@"
+    r"|\b(?:gh[pousr]_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,})"
+    r")",
+    re.IGNORECASE,
+)
+_REDACTED_SECRET = "[redacted]"
+_REDACTED_COPY_EXTENSIONS = {".html", ".json", ".log", ".md", ".out", ".txt", ".xml"}
+_REDACT_STAGING_DIRNAME = ".pybuilder-integration-redact"
+_REDACT_TEMP_FILES = set()
+_SUBPROCESS_LOG_JOIN_SECONDS = 30
+
+
+def _log_parallel_verify_environment_summary(logger: Logger, results):
+    summary = _build_parallel_verify_environment_summary(results)
+    print(summary)
+    github_summary_path = os.environ.get("GITHUB_STEP_SUMMARY")
+    if not github_summary_path:
+        return
+    try:
+        with os.fdopen(
+            os.open(github_summary_path, os.O_WRONLY | os.O_CREAT | os.O_APPEND, 0o600),
+            "a",
+            encoding="utf-8",
+        ) as summary_file:
+            summary_file.write(summary)
+            if not summary.endswith("\n"):
+                summary_file.write("\n")
+    except OSError:
+        logger.warn("Could not append parallel verify_environment summary to GITHUB_STEP_SUMMARY")
+
+
+def _build_parallel_verify_environment_summary(results):
+    lines = ["Parallel verify_environment summary"]
+    for result in results:
+        status = "PASSED" if result["exit_code"] == 0 else "FAILED"
+        lines.append(f"  {result['name']}: {status} (exit_code={result['exit_code']})")
+    for result in results:
+        if result["exit_code"] == 0:
+            continue
+        lines.append(f"  {result['name']} log: {result['log_file']}")
+        for hint in _extract_parallel_verify_failure_hints(result["log_file"]):
+            lines.append(f"    {hint}")
+    return "\n".join(lines) + "\n"
+
+
+def _extract_parallel_verify_failure_hints(log_file, max_hints=12):
+    if not log_file or not os.path.exists(log_file):
+        return ["child log was not found"]
+    try:
+        with open(log_file, encoding="utf-8", errors="replace") as log_handle:
+            raw = log_handle.read()
+    except OSError:
+        return ["child log could not be read"]
+    text = _ANSI_ESCAPE.sub("", raw)
+    lines = [line.rstrip() for line in text.splitlines()]
+    last_running = None
+    last_build_failed = None
+    failed_tests = []
+    session_summaries = []
+    extra_failures = []
+    for line in lines:
+        stripped = line.strip()
+        if not stripped:
+            continue
+        if _SUITE_RUNNING_LINE.match(stripped):
+            last_running = stripped
+        elif stripped.startswith("BUILD FAILED"):
+            last_build_failed = stripped
+        elif stripped.startswith("FAILED ") and "::" in stripped:
+            failed_tests.append(stripped)
+        elif stripped.startswith("===") and "failed" in stripped.lower():
+            session_summaries.append(stripped)
+        elif stripped.startswith("### FAIL") or "Failed to execute cypress" in stripped:
+            extra_failures.append(stripped)
+    hints = []
+    if last_running:
+        hints.append(last_running)
+    if last_build_failed:
+        hints.append(last_build_failed)
+    hints.extend(extra_failures[-3:])
+    hints.extend(failed_tests[-8:])
+    hints.extend(session_summaries[-3:])
+    if hints:
+        return _without_secret_hint_lines(hints)[:max_hints]
+    tail = [line.strip() for line in lines[-20:] if line.strip()]
+    if not tail:
+        return ["child log was empty"]
+    return _without_secret_hint_lines(tail)[-max_hints:]
+
+
+def _start_subprocess_output_tee(process, log_handle, logger: Logger, pass_name):
+    stdout = getattr(process, "stdout", None)
+    if stdout is None or isinstance(stdout, (int, str)):
+        process._pybuilder_integration_log_thread = None
+        return
+
+    def tee():
+        prefix = f"[{pass_name}] "
+        try:
+            for line in stdout:
+                redacted = _redact_secret_log_line(_decode_subprocess_stdout_line(line))
+                try:
+                    log_handle.write(redacted + "\n")
+                    log_handle.flush()
+                except Exception:
+                    pass
+                try:
+                    logger.info(prefix + redacted)
+                except Exception:
+                    pass
+        finally:
+            try:
+                stdout.close()
+            except Exception:
+                pass
+
+    thread = threading.Thread(target=tee, name=f"verify-environment-{pass_name}-log", daemon=True)
+    thread.start()
+    process._pybuilder_integration_log_thread = thread
+
+
+def _close_subprocess_stdout(process):
+    stdout = getattr(process, "stdout", None)
+    if stdout is None or isinstance(stdout, (int, str)):
+        return
+    try:
+        stdout.close()
+    except Exception:
+        pass
+
+
+def _close_subprocess_log(process):
+    thread = getattr(process, "_pybuilder_integration_log_thread", None)
+    if thread is not None:
+        thread.join(timeout=_SUBPROCESS_LOG_JOIN_SECONDS)
+        if thread.is_alive():
+            _close_subprocess_stdout(process)
+            thread.join(timeout=_SUBPROCESS_LOG_JOIN_SECONDS)
+        if thread.is_alive():
+            return
+        process._pybuilder_integration_log_thread = None
+    log_handle = getattr(process, "_pybuilder_integration_log_handle", None)
+    if log_handle and not getattr(log_handle, "closed", True):
+        log_handle.close()
+
+
+def _decode_subprocess_stdout_line(line):
+    if isinstance(line, bytes):
+        line = line.decode("utf-8", "replace")
+    return line.rstrip("\n\r")
+
+
+def _redact_secret_log_line(line):
+    return _SECRET_HINT_LINE.sub(_REDACTED_SECRET, line)
+
+
+def _redact_secret_log_text(text):
+    if not text:
+        return text
+    return "\n".join(_redact_secret_log_line(line) for line in text.splitlines()) + ("\n" if text.endswith("\n") else "")
+
+
+def _without_secret_hint_lines(lines):
+    return [_redact_secret_log_line(line) for line in lines]
+
+
+_CHILD_OUTPUT_SOURCES = (
+    ("logs", "logs"),
+    ("reports", "reports"),
+    ("reports", "test-reports"),
+)
+_SUBPROCESS_WORKDIR_SKIP = {".pybuilder", "target", ".git", ".nudge-ci-venv"}
+_CHILD_TARGET_LINK_SKIP = {"verify_environment", "logs", "reports", "test-reports"}
+
+
+def _child_output_source_roots(stage_target):
+    return (
+        stage_target,
+        os.path.join(stage_target, "project", "target"),
+    )
+
+
+def _first_child_cypress_log(stage_target):
+    for source_root in _child_output_source_roots(stage_target):
+        candidate = os.path.join(source_root, "logs", "integration", "cypress_run.log")
+        if os.path.isfile(candidate):
+            return candidate
+    return None
+
+
+def _copy_maybe_redacted_file(src, dst, *, follow_symlinks=True):
+    if os.path.splitext(src)[1].lower() in _REDACTED_COPY_EXTENSIONS:
+        _copy_redacted_text_file(src, dst)
+        return dst
+    return shutil.copy2(src, dst, follow_symlinks=follow_symlinks)
+
+
+def _redact_text_file_inplace(path):
+    if os.path.islink(path) or not os.path.isfile(path):
+        return
+    try:
+        with open(path, encoding="utf-8", errors="replace") as source_file:
+            text = source_file.read()
+    except OSError:
+        return
+    redacted = _redact_secret_log_text(text)
+    if redacted == text:
+        return
+    fd, temporary_copy = tempfile.mkstemp(
+        prefix=f".{os.path.basename(path)}.",
+        suffix=".redact",
+        dir=tempfile.gettempdir(),
+    )
+    _register_redact_temp(temporary_copy)
+    try:
+        with os.fdopen(fd, "w", encoding="utf-8") as dest_file:
+            dest_file.write(redacted)
+            dest_file.flush()
+            os.fchmod(dest_file.fileno(), 0o600)
+        _replace_redacted_tempfile(temporary_copy, path)
+    except OSError:
+        _unlink_redact_temp(temporary_copy)
+
+
+def _register_redact_temp(path):
+    _REDACT_TEMP_FILES.add(path)
+    if not getattr(_register_redact_temp, "_atexit_registered", False):
+        atexit.register(_cleanup_redact_temps)
+        _register_redact_temp._atexit_registered = True
+
+
+def _unlink_redact_temp(path):
+    try:
+        os.unlink(path)
+    except OSError:
+        pass
+    _REDACT_TEMP_FILES.discard(path)
+
+
+def _cleanup_redact_temps():
+    for path in list(_REDACT_TEMP_FILES):
+        _unlink_redact_temp(path)
+
+
+def _same_device_staging_base(path):
+    dest = os.path.abspath(path)
+    dest_dev = os.stat(dest).st_dev
+    current = dest if os.path.isdir(dest) else os.path.dirname(dest)
+    last_same = current
+    outside_target = None
+    while True:
+        try:
+            if os.stat(current).st_dev != dest_dev:
+                break
+        except OSError:
+            break
+        last_same = current
+        if "target" not in os.path.abspath(current).split(os.sep):
+            outside_target = current
+            break
+        parent = os.path.dirname(current)
+        if parent == current:
+            break
+        current = parent
+    return outside_target or last_same
+
+
+def _same_device_staging_dir(path):
+    staging = os.path.join(_same_device_staging_base(path), _REDACT_STAGING_DIRNAME)
+    os.makedirs(staging, mode=0o700, exist_ok=True)
+    try:
+        os.chmod(staging, 0o700)
+    except OSError:
+        pass
+    return staging
+
+
+def _remove_empty_redact_staging_dir(staging):
+    try:
+        os.rmdir(staging)
+    except OSError:
+        pass
+
+
+def _purge_redact_staging_dir(staging):
+    if os.path.basename(os.path.abspath(staging)) != _REDACT_STAGING_DIRNAME:
+        return
+    if os.path.islink(staging) or not os.path.isdir(staging):
+        return
+    for name in os.listdir(staging):
+        path = os.path.join(staging, name)
+        try:
+            if os.path.isdir(path) and not os.path.islink(path):
+                shutil.rmtree(path)
+            else:
+                os.unlink(path)
+        except OSError:
+            pass
+        _REDACT_TEMP_FILES.discard(path)
+    _remove_empty_redact_staging_dir(staging)
+
+
+def _redact_staging_candidates(path):
+    candidates = []
+    try:
+        candidates.append(os.path.join(_same_device_staging_base(path), _REDACT_STAGING_DIRNAME))
+    except OSError:
+        pass
+    abs_path = os.path.abspath(path)
+    if os.path.isdir(abs_path):
+        candidates.append(os.path.join(abs_path, _REDACT_STAGING_DIRNAME))
+    return candidates
+
+
+def _purge_known_redact_staging_dirs(*paths):
+    seen = set()
+    for path in paths:
+        if not path or not os.path.exists(path):
+            continue
+        for staging in _redact_staging_candidates(path):
+            if staging in seen:
+                continue
+            seen.add(staging)
+            _purge_redact_staging_dir(staging)
+
+
+def _replace_redacted_tempfile(temporary_copy, path):
+    try:
+        os.replace(temporary_copy, path)
+        _REDACT_TEMP_FILES.discard(temporary_copy)
+        return
+    except OSError as error:
+        if getattr(error, "errno", None) != errno.EXDEV:
+            raise
+    staging = _same_device_staging_dir(path)
+    fd, local_copy = tempfile.mkstemp(
+        prefix=f".{os.path.basename(path)}.",
+        suffix=".redact",
+        dir=staging,
+    )
+    _register_redact_temp(local_copy)
+    try:
+        with os.fdopen(fd, "wb") as destination, open(temporary_copy, "rb") as source:
+            shutil.copyfileobj(source, destination)
+            destination.flush()
+            os.fchmod(destination.fileno(), 0o600)
+        os.replace(local_copy, path)
+        _REDACT_TEMP_FILES.discard(local_copy)
+    except OSError:
+        _unlink_redact_temp(local_copy)
+        raise
+    finally:
+        _unlink_redact_temp(temporary_copy)
+        _remove_empty_redact_staging_dir(staging)
+
+
+def _redact_directory_text_files(root):
+    if not os.path.isdir(root):
+        return
+    _purge_known_redact_staging_dirs(root)
+    for dirpath, dirnames, filenames in os.walk(root):
+        if _REDACT_STAGING_DIRNAME in dirnames:
+            dirnames.remove(_REDACT_STAGING_DIRNAME)
+        for name in filenames:
+            if os.path.splitext(name)[1].lower() not in _REDACTED_COPY_EXTENSIONS:
+                continue
+            _redact_text_file_inplace(os.path.join(dirpath, name))
+
+
+def _copy_redacted_text_file(src, dst):
+    parent = os.path.dirname(dst)
+    if parent:
+        os.makedirs(parent, exist_ok=True)
+    try:
+        with open(src, encoding="utf-8", errors="replace") as source_file:
+            text = _redact_secret_log_text(source_file.read())
+    except OSError:
+        shutil.copy2(src, dst)
+        return
+    with os.fdopen(os.open(dst, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600), "w", encoding="utf-8") as dest_file:
+        dest_file.write(text)
+
+
 def _merge_parallel_verify_environment_outputs(project: Project, passes):
     parent_target = project.expand_path("$dir_target")
+    _purge_known_redact_staging_dirs(parent_target, project.basedir)
     parent_logs_directory = prepare_logs_directory(project)
-    parent_output_directories = [
-        ("logs", parent_logs_directory),
-        ("reports", prepare_reports_directory(project)),
-    ]
+    parent_destinations = {
+        "logs": parent_logs_directory,
+        "reports": prepare_reports_directory(project),
+    }
     parent_cypress_log = os.path.join(parent_logs_directory, "cypress_run.log")
     has_parent_cypress_log = False
     for pass_config in passes:
         stage_target = os.path.join(parent_target, "verify_environment", pass_config["name"])
-        for output_directory, destination_directory in parent_output_directories:
-            source = os.path.join(stage_target, output_directory, "integration")
-            if os.path.exists(source):
+        for source_root in _child_output_source_roots(stage_target):
+            for destination_kind, source_dirname in _CHILD_OUTPUT_SOURCES:
+                source = os.path.join(source_root, source_dirname, "integration")
+                if not os.path.exists(source):
+                    continue
+                _redact_directory_text_files(source)
                 destination = os.path.join(
-                    destination_directory,
+                    parent_destinations[destination_kind],
                     "parallel",
                     pass_config["name"],
                 )
-                shutil.copytree(source, destination, dirs_exist_ok=True)
-                if output_directory == "logs":
-                    cypress_log = os.path.join(source, "cypress_run.log")
-                    if os.path.exists(cypress_log):
-                        _copy_cypress_log(cypress_log, parent_cypress_log, has_parent_cypress_log)
-                        has_parent_cypress_log = True
+                shutil.copytree(source, destination, dirs_exist_ok=True, copy_function=_copy_maybe_redacted_file)
+        cypress_log = _first_child_cypress_log(stage_target)
+        if cypress_log:
+            _copy_cypress_log(cypress_log, parent_cypress_log, has_parent_cypress_log)
+            has_parent_cypress_log = True
 
 
 def _copy_cypress_log(source, destination, append):
+    try:
+        with open(source, encoding="utf-8", errors="replace") as source_file:
+            text = _redact_secret_log_text(source_file.read())
+    except OSError:
+        return
+    if text and not text.endswith("\n"):
+        text += "\n"
     flags = os.O_WRONLY | os.O_CREAT | (os.O_APPEND if append else os.O_TRUNC)
-    mode = "ab" if append else "wb"
-    with open(source, "rb") as source_file:
-        with os.fdopen(os.open(destination, flags, 0o600), mode) as destination_file:
-            shutil.copyfileobj(source_file, destination_file)
+    mode = "a" if append else "w"
+    with os.fdopen(os.open(destination, flags, 0o600), mode, encoding="utf-8") as destination_file:
+        destination_file.write(text)
 
 
-def _start_verify_environment_subprocess(project: Project, logger: Logger, pass_config, properties_file):
-    log_file = os.path.join(prepare_logs_directory(project), f"verify_environment_{pass_config['name']}.log")
-    command = _build_verify_environment_subprocess_command(project, pass_config)
+def _verify_environment_subprocess_stage_dir(project: Project, pass_config):
+    return os.path.join(
+        project.expand_path("$dir_target"),
+        "verify_environment",
+        pass_config["name"],
+    )
+
+
+def _verify_environment_subprocess_workdir_path(project: Project, pass_config):
+    return os.path.join(_verify_environment_subprocess_stage_dir(project, pass_config), "project")
+
+
+def _prepare_verify_environment_subprocess_workdir(project: Project, pass_config):
+    stage_dir = _verify_environment_subprocess_stage_dir(project, pass_config)
+    workdir = _verify_environment_subprocess_workdir_path(project, pass_config)
+    if os.path.exists(stage_dir):
+        shutil.rmtree(stage_dir)
+    os.makedirs(workdir)
+    for name in os.listdir(project.basedir):
+        if name in _SUBPROCESS_WORKDIR_SKIP:
+            continue
+        os.symlink(os.path.join(project.basedir, name), os.path.join(workdir, name))
+    _link_parent_target_tree(project, workdir)
+    source_plugins = os.path.join(project.basedir, ".pybuilder")
+    if os.path.isdir(source_plugins):
+        destination_plugins = os.path.join(workdir, ".pybuilder")
+        shutil.copytree(source_plugins, destination_plugins, symlinks=True)
+        _materialize_external_venv_pythons(os.path.join(destination_plugins, "plugins"))
+    return workdir
+
+
+def _link_parent_target_tree(project: Project, workdir):
+    parent_target = project.expand_path("$dir_target")
+    child_target = os.path.join(workdir, "target")
+    os.makedirs(child_target, exist_ok=True)
+    if not os.path.isdir(parent_target):
+        return
+    for name in os.listdir(parent_target):
+        if name in _CHILD_TARGET_LINK_SKIP:
+            continue
+        os.symlink(os.path.join(parent_target, name), os.path.join(child_target, name))
+
+
+def _is_venv_python_launcher(name):
+    if name in {"python", "python3"}:
+        return True
+    if name.startswith("python3."):
+        return name[len("python"):].replace(".", "").isdigit()
+    return False
+
+
+def _is_real_directory(path):
+    return os.path.isdir(path) and not os.path.islink(path)
+
+
+def _is_path_within(path, root):
+    root_real = os.path.realpath(root)
+    try:
+        return os.path.commonpath([root_real, os.path.realpath(path)]) == root_real
+    except ValueError:
+        return False
+
+
+def _materialize_external_venv_pythons(plugins_root):
+    if not _is_real_directory(plugins_root):
+        return
+    plugins_root_real = os.path.realpath(plugins_root)
+    for version_dir in os.listdir(plugins_root):
+        version_root = os.path.join(plugins_root, version_dir)
+        bin_dir = os.path.join(version_root, "bin")
+        if not _is_real_directory(version_root) or not _is_real_directory(bin_dir):
+            continue
+        bin_dir_real = os.path.realpath(bin_dir)
+        if not _is_path_within(bin_dir_real, plugins_root_real):
+            continue
+        version_root_real = os.path.realpath(version_root)
+        for name in os.listdir(bin_dir_real):
+            if not _is_venv_python_launcher(name):
+                continue
+            path = os.path.join(bin_dir_real, name)
+            if not os.path.islink(path):
+                continue
+            target = os.path.realpath(path)
+            if not os.path.isfile(target):
+                continue
+            if _is_path_within(target, version_root_real):
+                continue
+            # mkstemp uses O_EXCL so a planted *.materialize symlink cannot
+            # redirect the write outside the staged workdir.
+            fd, temporary_copy = tempfile.mkstemp(
+                prefix=f".{name}.",
+                suffix=".materialize",
+                dir=bin_dir_real,
+            )
+            try:
+                with os.fdopen(fd, "wb") as destination, open(target, "rb") as source:
+                    shutil.copyfileobj(source, destination)
+                    destination.flush()
+                    os.fchmod(destination.fileno(), 0o700)
+                os.replace(temporary_copy, path)
+            except Exception:
+                try:
+                    os.unlink(temporary_copy)
+                except OSError:
+                    pass
+                raise
+
+
+def _plugin_python_executable(plugins_root):
+    if not os.path.isdir(plugins_root):
+        return None
+    for version_dir in sorted(os.listdir(plugins_root)):
+        candidate = os.path.join(plugins_root, version_dir, "bin", "python")
+        if os.path.isfile(candidate) and os.access(candidate, os.X_OK):
+            return candidate
+    return None
+
+
+_PYBUILDER_CLI_MAIN = "import sys; from pybuilder.cli import main; raise SystemExit(main(*sys.argv[1:]))"
+
+
+def _isolated_plugin_python_command(plugin_python, args):
+    pyb_script = os.path.join(os.path.dirname(plugin_python), "pyb")
+    if os.path.isfile(pyb_script):
+        return [plugin_python, "-u", pyb_script] + args
+    return [plugin_python, "-u", "-c", _PYBUILDER_CLI_MAIN] + args
+
+
+def _uses_isolated_plugin_python(command):
+    if len(command) < 2:
+        return False
+    args = command[1:]
+    if args and args[0] == "-u":
+        args = args[1:]
+    if not args:
+        return False
+    if args[0] == "-c":
+        return len(args) >= 2 and args[1] == _PYBUILDER_CLI_MAIN
+    return os.path.basename(args[0]) == "pyb"
+
+
+def _verify_environment_subprocess_env(workdir, command, properties_file):
     env = os.environ.copy()
     env[SUBPROCESS_PROPERTIES_FILE_ENV] = properties_file
-    logger.info(f"Starting {pass_config['name']} verify_environment subprocess: {' '.join(command)}")
+    env["PYTHONUNBUFFERED"] = "1"
+    env.pop("GITHUB_STEP_SUMMARY", None)
+    env.pop("PYTHONHOME", None)
+    env.pop("VIRTUAL_ENV", None)
+    env.pop("PYTHONPATH", None)
+    return env
+
+
+def _start_verify_environment_subprocess(project: Project, logger: Logger, pass_config, properties_file):
+    log_file = os.path.join(prepare_logs_directory(project), f"verify_environment_{pass_config['name']}.log")
+    workdir = _prepare_verify_environment_subprocess_workdir(project, pass_config)
+    command = _build_verify_environment_subprocess_command(project, pass_config, workdir)
+    env = _verify_environment_subprocess_env(workdir, command, properties_file)
+    logger.info(
+        f"Starting {pass_config['name']} verify_environment subprocess in {workdir}: {' '.join(command)}"
+    )
     log_handle = os.fdopen(
         os.open(log_file, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600),
         "w",
@@ -197,30 +774,42 @@ def _start_verify_environment_subprocess(project: Project, logger: Logger, pass_
     )
     try:
         process = subprocess.Popen(command,
-                                   stdout=log_handle,
+                                   stdout=subprocess.PIPE,
                                    stderr=subprocess.STDOUT,
-                                   cwd=project.basedir,
+                                   cwd=workdir,
                                    env=env,
                                    shell=False)
+        process._pybuilder_integration_log_handle = log_handle
+        _start_subprocess_output_tee(process, log_handle, logger, pass_config["name"])
     except Exception:
         log_handle.close()
         raise
-    process._pybuilder_integration_log_handle = log_handle
     return process, log_file
 
 
-def _build_verify_environment_subprocess_command(project: Project, pass_config):
-    stage_target = os.path.join(project.expand_path("$dir_target"), "verify_environment", pass_config["name"])
-    return [
-        "pyb",
+def _build_verify_environment_subprocess_command(project: Project, pass_config, workdir=None):
+    stage_target = _verify_environment_subprocess_stage_dir(project, pass_config)
+    args = [
+        "--no-venvs",
         pass_config["task"],
         "-P", f"{WORKING_TEST_DIR}={pass_config['test_dir']}",
         "-P", f"{PARALLEL_VERIFY_ENVIRONMENT}=False",
         "-P", f"{PROMOTE_ARTIFACT}=False",
         "-P", f"dir_target={stage_target}",
         "-P", f"dir_logs={os.path.join(stage_target, 'logs')}",
-        "-P", f"dir_reports={os.path.join(stage_target, 'reports')}",
+        "-P", f"dir_reports={os.path.join(stage_target, 'test-reports')}",
     ]
+    if not workdir:
+        raise BuildFailedException(
+            f"Cannot start isolated verify_environment subprocess for {pass_config['name']}: workdir is required"
+        )
+    plugin_python = _plugin_python_executable(os.path.join(workdir, ".pybuilder", "plugins"))
+    if not plugin_python:
+        raise BuildFailedException(
+            f"Cannot start isolated verify_environment subprocess for {pass_config['name']}: "
+            "copied plugin python is missing or not executable"
+        )
+    return _isolated_plugin_python_command(plugin_python, args)
 
 
 def _write_subprocess_properties_file(project: Project):
@@ -372,11 +961,23 @@ def _run_cypress_tests_in_directory(work_dir, logger, project, reactor: Reactor)
 
 
 def _write_cypress_summary(project, logger):
-    """Parse cypress_run.log and write a portable Markdown summary artifact."""
+    """Parse cypress_run.log and write a portable Markdown summary artifact.
+
+    No-op when Cypress did not run (missing or empty cypress_run.log), so
+    verify_environment jobs without Cypress do not emit a false warning.
+    Parallel child subprocesses also skip it; the parent writes one summary
+    after merging child Cypress logs.
+    """
     log_path = os.path.join(prepare_logs_directory(project), "cypress_run.log")
+    if os.environ.get(SUBPROCESS_PROPERTIES_FILE_ENV):
+        logger.debug("Skipping Cypress summary in verify_environment subprocess")
+        return None
+    if not os.path.isfile(log_path) or os.path.getsize(log_path) == 0:
+        logger.debug("Skipping Cypress summary: cypress_run.log not found")
+        return None
     summary_path = os.path.join(prepare_reports_directory(project), "cypress-summary.md")
     try:
-        output = _build_cypress_summary(log_path)
+        output = _redact_secret_log_text(_build_cypress_summary(log_path))
         with os.fdopen(
             os.open(summary_path, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600),
             "w",

{pybuilder_integration-106 → pybuilder_integration-108}/pybuilder_integration.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pybuilder-integration
-Version: 106
+Version: 108
 Summary: A pybuilder plugin that runs integration tests (Tavern & Cypress) against a target.
 Home-page: https://github.com/rspitler/pybuilder-integration
 Author: 

{pybuilder_integration-106 → pybuilder_integration-108}/setup.py

@@ -21,7 +21,7 @@ class install(_install):
 if __name__ == '__main__':
     setup(
         name = 'pybuilder-integration',
-        version = '106',
+        version = '108',
         description = 'A pybuilder plugin that runs integration tests (Tavern & Cypress) against a target.',
         long_description = 'A pybuilder plugin that runs integration tests against a target.  This is intended to be a broader scope than unit-tests encompassing dependant functionality.',
         long_description_content_type = None,