#python.src.stricttest.pushguard

#python.src.stricttest.pushguard

Structural push guard: a real git push to a NON-LOCAL remote is impossible.

The originating forensics: a test mocked a command's run/run_gh helpers but NOT its push helper, so a full-suite run executed a REAL git push origin main from the real development repository. This guard closes that class of bug at the innermost real-execution boundary -- subprocess.Popen, which subprocess.run funnels through. A test that mocks subprocess.run in some namespace never reaches Popen, so the guard composes with existing mock layering instead of fighting it.

Local filesystem paths and file:// URLs are ALLOWED: suites push to local bare repos constantly.

pytest.fail raises Failed (a BaseException subclass), so it slips past production except Exception handlers and surfaces loudly even when a caller would otherwise swallow the push error.

#remote_is_local

def remote_is_local(url: str | None) -> bool

Classify a git remote URL/path as local (allowed) or non-local (blocked).

Local: file:// URLs and bare filesystem paths (absolute or relative). Non-local: any URL with a non-file scheme (https://, ssh://, git://) and SCP-like syntax (git@host:owner/repo). None/empty is treated as non-local (cannot prove locality -> block loudly).

#extract_push_remote

def extract_push_remote(cmd) -> str | None

Return the remote argument of a git push command list, or None.

#make_guarded_popen

def make_guarded_popen(real_popen)

Wrap real_popen so a non-local git push fails the test.