CI: share test helpers in 17 more test files (#824) (#1402)

* Share test helpers in 17 more CLI test files

Seventeen CLI test files still carried their own copies of the
binary() and git_sha256 helpers. They now use the shared ones in
tests/common, so a fix to either helper reaches every suite at
once.

The helper-copy ratchet (cli/shared_helper_copies.rs) drops these
files from its pending list, plus a stale entry for a deleted file,
so new copies there fail the test. The scan/ and repair/ files that
an open PR touches and the four shared *_common modules stay
pending.

Refs #824

Assisted-by: Claude Code:claude-opus-5-5

* Drop duplicate cache_env module in two tests

in_process_alternate_installers and in_process_gem_apply compiled
tests/common/cache_env.rs twice, once on its own and once inside
mod common, so its selftests ran twice per run. Both files now use
common::cache_env.

Refs #824

Assisted-by: Claude Code:claude-opus-5-5

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: mikolalysenko

crates/socket-patch-cli/tests/apply/apply_network.rs

@@ -10,29 +10,16 @@
 //!   - `apply` against installed packages writes patched content to
 //!     node_modules and leaves `.socket/` byte-identical.
 
-use std::path::{Path, PathBuf};
+use std::path::Path;
 use std::process::Command;
 
-use sha2::{Digest, Sha256};
 use wiremock::matchers::{method, path};
 use wiremock::{Mock, MockServer, ResponseTemplate};
 
-fn binary() -> PathBuf {
-    env!("CARGO_BIN_EXE_socket-patch").into()
-}
+use crate::common::{binary, git_sha256};
 
 const ORG_SLUG: &str = "test-org";
 
-/// Git-SHA256: SHA256("blob <len>\0" ++ content). Matches the binary's
-/// content-addressable hashing.
-fn git_sha256(content: &[u8]) -> String {
-    let header = format!("blob {}\0", content.len());
-    let mut hasher = Sha256::new();
-    hasher.update(header.as_bytes());
-    hasher.update(content);
-    hex::encode(hasher.finalize())
-}
-
 fn write_npm_package(root: &Path, name: &str, version: &str, file_path: &str, file_content: &[u8]) {
     let pkg_dir = root.join("node_modules").join(name);
     std::fs::create_dir_all(&pkg_dir).expect("create pkg dir");

crates/socket-patch-cli/tests/cli/api_client_errors_e2e.rs

@@ -5,14 +5,12 @@
 //! (`status`/`error`) on stdout, so a regression that turns a real API
 //! failure into a fake success fails loudly.
 
-use std::path::{Path, PathBuf};
+use std::path::Path;
 
 use wiremock::matchers::{method, path};
 use wiremock::{Mock, MockServer, ResponseTemplate};
 
-fn binary() -> PathBuf {
-    env!("CARGO_BIN_EXE_socket-patch").into()
-}
+use crate::common::binary;
 
 const ORG_SLUG: &str = "test-org";
 const UUID: &str = "11111111-1111-4111-8111-111111111111";

crates/socket-patch-cli/tests/cli/shared_helper_copies.rs

@@ -14,28 +14,10 @@ use std::path::Path;
 /// a stale entry is not an error, so a PR that migrates one never turns
 /// another red.
 const PENDING_PRIVATE_HELPERS: &[&str] = &[
-    "apply/apply_network.rs",
-    "cli/api_client_errors_e2e.rs",
-    "diff_created_file_e2e.rs",
-    "e2e_vex_vendor.rs",
-    "in_process_agent_reapply.rs",
-    "in_process_alternate_installers.rs",
-    "in_process_cargo_apply.rs",
-    "in_process_edge_cases.rs",
-    "in_process_gem_apply.rs",
-    "in_process_gem_multi_platform.rs",
-    "in_process_get_manifest_path.rs",
-    "in_process_pypi_apply.rs",
-    "in_process_pypi_multi_release.rs",
-    "in_process_remote_ecosystems_apply.rs",
-    "in_process_remove_repair_lifecycle.rs",
-    "remove_rollback_api_overrides.rs",
     "repair/covgap_commands_repair.rs",
     "repair/covgap_commands_repair_vendor.rs",
     "repair/repair_invariants.rs",
-    "rollback/rollback_multicopy_blob_gate.rs",
     "scan/covgap_commands_fetch_stage.rs",
-    "scan_vendor_e2e.rs",
     "vex_e2e_common/mod.rs",
     "vlt_e2e_common/mod.rs",
     "vlt_hosted_common/mod.rs",

crates/socket-patch-cli/tests/e2e_vex_vendor.rs

@@ -39,9 +39,9 @@ use socket_patch_core::vendor::state::{
 /// the uuid path level, so fixtures must use the real shape.
 const UUID: &str = "9f6b2c4e-1d3a-4f6b-8c2d-7e5a9b1c3d5f";
 
-fn binary() -> &'static str {
-    env!("CARGO_BIN_EXE_socket-patch")
-}
+#[path = "common/mod.rs"]
+mod common;
+use common::binary;
 
 /// CLI invocation with the ambient `SOCKET_*` environment scrubbed (same
 /// rationale as `e2e_vex.rs`: explicit flags must be the sole source of

crates/socket-patch-cli/tests/in_process_agent_reapply.rs

@@ -11,7 +11,6 @@
 use std::path::Path;
 
 use serial_test::serial;
-use sha2::{Digest, Sha256};
 use socket_patch_cli::commands::get::{run as get_run, GetArgs};
 use socket_patch_cli::commands::scan::{run as scan_run, ScanArgs, ScanMode};
 use wiremock::matchers::{method, path, path_regex};
@@ -25,12 +24,9 @@ const UUID: &str = "45445445-4544-4544-8544-454454454454";
 const ORIGINAL: &[u8] = b"module.exports = 'original';\n";
 const PATCHED: &[u8] = b"module.exports = 'patched';\n";
 
-fn git_sha256(content: &[u8]) -> String {
-    let mut hasher = Sha256::new();
-    hasher.update(format!("blob {}\0", content.len()).as_bytes());
-    hasher.update(content);
-    hex::encode(hasher.finalize())
-}
+#[path = "common/mod.rs"]
+mod common;
+use common::git_sha256;
 
 fn common(cwd: &Path, server: &MockServer) -> socket_patch_cli::args::GlobalArgs {
     socket_patch_cli::args::GlobalArgs {

crates/socket-patch-cli/tests/in_process_alternate_installers.rs

@@ -9,19 +9,11 @@ use std::path::{Path, PathBuf};
 use std::process::Command;
 
 use serial_test::serial;
-use sha2::{Digest, Sha256};
 use socket_patch_cli::commands::apply::{run as apply_run, ApplyArgs};
 
-#[path = "common/cache_env.rs"]
-mod cache_env;
-
-fn git_sha256(content: &[u8]) -> String {
-    let header = format!("blob {}\0", content.len());
-    let mut hasher = Sha256::new();
-    hasher.update(header.as_bytes());
-    hasher.update(content);
-    hex::encode(hasher.finalize())
-}
+#[path = "common/mod.rs"]
+mod common;
+use common::{cache_env, git_sha256};
 
 /// Strong oracle: the file at `path` must now contain EXACTLY the expected
 /// patched bytes, its git-sha256 must equal the manifest's afterHash, and

crates/socket-patch-cli/tests/in_process_cargo_apply.rs

@@ -9,7 +9,6 @@ use std::process::Command;
 
 use base64::Engine;
 use serial_test::serial;
-use sha2::{Digest, Sha256};
 use socket_patch_cli::commands::scan::{run as scan_run, ScanArgs};
 use wiremock::matchers::{method, path, path_regex};
 use wiremock::{Mock, MockServer, ResponseTemplate};
@@ -19,13 +18,9 @@ const UUID: &str = "14141414-1414-4141-8141-141414141414";
 const CRATE_NAME: &str = "cfg-if";
 const CRATE_VERSION: &str = "1.0.0";
 
-fn git_sha256(content: &[u8]) -> String {
-    let header = format!("blob {}\0", content.len());
-    let mut hasher = Sha256::new();
-    hasher.update(header.as_bytes());
-    hasher.update(content);
-    hex::encode(hasher.finalize())
-}
+#[path = "common/mod.rs"]
+mod common;
+use common::git_sha256;
 
 fn has_cargo() -> bool {
     Command::new("cargo")

crates/socket-patch-cli/tests/in_process_edge_cases.rs

@@ -8,17 +8,12 @@
 use std::path::Path;
 
 use serial_test::serial;
-use sha2::{Digest, Sha256};
 use socket_patch_cli::commands::apply::{run as apply_run, ApplyArgs};
 use socket_patch_cli::commands::rollback::{run as rollback_run, RollbackArgs};
 
-fn git_sha256(content: &[u8]) -> String {
-    let header = format!("blob {}\0", content.len());
-    let mut hasher = Sha256::new();
-    hasher.update(header.as_bytes());
-    hasher.update(content);
-    hex::encode(hasher.finalize())
-}
+#[path = "common/mod.rs"]
+mod common;
+use common::git_sha256;
 
 /// Identity fingerprint of a file that survives a byte-identical rewrite check.
 ///

crates/socket-patch-cli/tests/in_process_gem_apply.rs

@@ -9,26 +9,18 @@ use std::process::Command;
 
 use base64::Engine;
 use serial_test::serial;
-use sha2::{Digest, Sha256};
 use socket_patch_cli::commands::scan::{run as scan_run, ScanArgs};
 use wiremock::matchers::{method, path, path_regex};
 use wiremock::{Mock, MockServer, ResponseTemplate};
 
-#[path = "common/cache_env.rs"]
-mod cache_env;
-
 const ORG: &str = "test-org";
 const UUID: &str = "13131313-1313-4131-8131-131313131313";
 const GEM_NAME: &str = "colorize";
 const GEM_VERSION: &str = "1.1.0";
 
-fn git_sha256(content: &[u8]) -> String {
-    let header = format!("blob {}\0", content.len());
-    let mut hasher = Sha256::new();
-    hasher.update(header.as_bytes());
-    hasher.update(content);
-    hex::encode(hasher.finalize())
-}
+#[path = "common/mod.rs"]
+mod common;
+use common::{cache_env, git_sha256};
 
 fn has_gem() -> bool {
     Command::new("gem")

crates/socket-patch-cli/tests/in_process_gem_multi_platform.rs

@@ -27,7 +27,6 @@ use std::path::{Path, PathBuf};
 
 use base64::Engine;
 use serial_test::serial;
-use sha2::{Digest, Sha256};
 use socket_patch_cli::commands::remove::{run as remove_run, RemoveArgs};
 use socket_patch_cli::commands::rollback::{run as rollback_run, RollbackArgs};
 use socket_patch_cli::commands::scan::{run as scan_run, ScanArgs};
@@ -69,13 +68,9 @@ fn darwin_after_bytes() -> Vec<u8> {
     p
 }
 
-fn git_sha256(content: &[u8]) -> String {
-    let header = format!("blob {}\0", content.len());
-    let mut hasher = Sha256::new();
-    hasher.update(header.as_bytes());
-    hasher.update(content);
-    hex::encode(hasher.finalize())
-}
+#[path = "common/mod.rs"]
+mod common;
+use common::git_sha256;
 
 fn b64(bytes: &[u8]) -> String {
     base64::engine::general_purpose::STANDARD.encode(bytes)