DEVX-140: feat: make check_test_isolation configurable via pyproject.toml

src/devx/tools/check_test_isolation.py

@@ -25,6 +25,25 @@ This module is used in two ways:
    findings are reported as advisories (exit 0) since static analysis
    can't predict early exits — the runtime audit is authoritative.
 
+Project-Specific Configuration
+-------------------------------
+
+Projects can extend the built-in rule sets via ``[tool.devx.check_test_isolation]``
+in ``pyproject.toml``.  Entries are merged on top of the defaults — they
+add to (not replace) the built-in rules::
+
+    [tool.devx.check_test_isolation]
+    # Functions known to do filesystem or network I/O
+    io_functions = { "my_func" = "reads config from disk", ... }
+    # Functions known to spawn subprocesses
+    subprocess_helpers = { "my_helper" = "calls subprocess.run", ... }
+    # Transitive deps: if a helper calls these, patching any of them is safe
+    helper_internal_calls = { "my_helper" = ["subprocess", "run_cmd"], ... }
+    # I/O function internal deps: patching any of these makes the call safe
+    io_internal_calls = { "my_func" = ["open", "yaml"], ... }
+    # Heavy modules slow to import at module level in test files
+    heavy_module_imports = { "mymodule" = 150.0, ... }
+
 Patterns detected:
 
 1. **Unpatched subprocess calls** — test functions that call
@@ -60,6 +79,7 @@ from pathlib import Path
 
 import click
 
+from devx.config import _load_pyproject_devx
 from devx.i18n import _
 
 # ── Configuration ─────────────────────────────────────────────────────────────
@@ -71,7 +91,7 @@ DEFAULT_MAX_LOOP_ITERATIONS = 100
 # Maps module name → approximate import time in milliseconds.
 # NOTE: ``requests`` is excluded because it's a core devx dependency —
 # it's loaded during collection regardless of whether test files import it.
-HEAVY_MODULE_IMPORTS: dict[str, float] = {
+_DEFAULT_HEAVY_MODULE_IMPORTS: dict[str, float] = {
     "httpx": 80.0,
     "aiohttp": 120.0,
     "docker": 90.0,
@@ -96,7 +116,7 @@ HEAVY_MODULE_IMPORTS: dict[str, float] = {
 # Functions known to spawn subprocesses.  When a test calls any of these
 # without patching them, the real subprocess runs.
 # Maps function name → human-readable description.
-KNOWN_SUBPROCESS_HELPERS: dict[str, str] = {
+_DEFAULT_SUBPROCESS_HELPERS: dict[str, str] = {
     "update_doc_versions": "calls subprocess.run to run check_doc_versions --fix",
     "run_tests": "calls run_cmd to run make lint-ruff and make pytest-cov",
     "run_cmd": "calls subprocess.run for shell commands",
@@ -105,7 +125,7 @@ KNOWN_SUBPROCESS_HELPERS: dict[str, str] = {
 # Functions known to do filesystem or network I/O that should be mocked in tests.
 # Maps function name → description of what I/O it does.
 # If a test calls one of these without a corresponding @patch, it's a violation.
-KNOWN_IO_FUNCTIONS: dict[str, str] = {  # nosec B105 — descriptions, not passwords
+_DEFAULT_IO_FUNCTIONS: dict[str, str] = {  # nosec B105 — descriptions, not passwords
     "get_pat": "reads ZITADEL PAT from filesystem/env (ZitadelAuth._iter_sources)",
     "load_secrets": "reads YAML config file from disk",
     "get_customer_secret": "reads customer-specific config from disk",
@@ -124,7 +144,7 @@ KNOWN_IO_FUNCTIONS: dict[str, str] = {  # nosec B105 — descriptions, not passw
 # Transitive dependencies: if a helper calls another helper that is patched,
 # the call is safe.  Maps helper → set of function names it internally calls.
 # If ANY of these are in the test's patches, the helper call is safe.
-HELPER_INTERNAL_CALLS: dict[str, set[str]] = {
+_DEFAULT_HELPER_INTERNAL_CALLS: dict[str, set[str]] = {
     "run_tests": {"run_cmd", "subprocess"},
     "update_doc_versions": {"subprocess"},
     "run_cmd": {"subprocess"},
@@ -133,7 +153,7 @@ HELPER_INTERNAL_CALLS: dict[str, set[str]] = {
 # I/O function internal dependencies: if a test patches one of these
 # internal dependencies, the I/O function call is considered safe.
 # Maps I/O function name → set of internal function/method names it calls.
-IO_INTERNAL_CALLS: dict[str, set[str]] = {
+_DEFAULT_IO_INTERNAL_CALLS: dict[str, set[str]] = {
     "get_customer_vm_ip": {"get_tofu_output", "get_tofu_vm_ip", "subprocess"},
     "get_observability_vm_ip": {"get_tofu_output", "get_tofu_vm_ip", "subprocess"},
     "get_pat": {
@@ -150,6 +170,76 @@ IO_INTERNAL_CALLS: dict[str, set[str]] = {
     "get_customer_secret": {"load_customer_secrets", "load_vault_yaml", "load_secrets", "REPO_ROOT", "open"},
 }
 
+
+def _load_test_isolation_config() -> None:
+    """Merge project-specific rules from ``[tool.devx.check_test_isolation]``.
+
+    Reads from pyproject.toml and merges with defaults. Project-specific
+    entries are added on top of (not replacing) the built-in defaults.
+
+    Supported keys::
+
+        [tool.devx.check_test_isolation]
+        io_functions = { "my_func" = "does network I/O", ... }
+        subprocess_helpers = { "my_helper" = "calls subprocess.run", ... }
+        helper_internal_calls = { "my_helper" = ["subprocess", "run_cmd"], ... }
+        io_internal_calls = { "my_func" = ["open", "yaml"], ... }
+        heavy_module_imports = { "mymodule" = 150.0, ... }
+    """
+    devx_cfg = _load_pyproject_devx()
+    cfg_raw = devx_cfg.get("check_test_isolation", {})
+    if not isinstance(cfg_raw, dict):
+        return
+    cfg: dict[str, object] = cfg_raw  # type: ignore[assignment]
+
+    # io_functions: {name: description}
+    io_extra = cfg.get("io_functions", {})
+    if isinstance(io_extra, dict):
+        for name, desc in io_extra.items():
+            if isinstance(name, str) and isinstance(desc, str):
+                KNOWN_IO_FUNCTIONS[name] = desc
+
+    # subprocess_helpers: {name: description}
+    sp_extra = cfg.get("subprocess_helpers", {})
+    if isinstance(sp_extra, dict):
+        for name, desc in sp_extra.items():
+            if isinstance(name, str) and isinstance(desc, str):
+                KNOWN_SUBPROCESS_HELPERS[name] = desc
+
+    # helper_internal_calls: {name: [deps]}
+    hic_extra = cfg.get("helper_internal_calls", {})
+    if isinstance(hic_extra, dict):
+        for name, deps in hic_extra.items():
+            if isinstance(name, str) and isinstance(deps, list):
+                deps_set = {str(d) for d in deps if isinstance(d, str)}
+                HELPER_INTERNAL_CALLS.setdefault(name, set()).update(deps_set)
+
+    # io_internal_calls: {name: [deps]}
+    iic_extra = cfg.get("io_internal_calls", {})
+    if isinstance(iic_extra, dict):
+        for name, deps in iic_extra.items():
+            if isinstance(name, str) and isinstance(deps, list):
+                deps_set = {str(d) for d in deps if isinstance(d, str)}
+                IO_INTERNAL_CALLS.setdefault(name, set()).update(deps_set)
+
+    # heavy_module_imports: {name: ms}
+    hmi_extra = cfg.get("heavy_module_imports", {})
+    if isinstance(hmi_extra, dict):
+        for name, ms in hmi_extra.items():
+            if isinstance(name, str) and isinstance(ms, (int, float)):
+                HEAVY_MODULE_IMPORTS[name] = float(ms)
+
+
+# Active rule sets — start with defaults, merged with project config at import.
+HEAVY_MODULE_IMPORTS: dict[str, float] = dict(_DEFAULT_HEAVY_MODULE_IMPORTS)
+KNOWN_SUBPROCESS_HELPERS: dict[str, str] = dict(_DEFAULT_SUBPROCESS_HELPERS)
+KNOWN_IO_FUNCTIONS: dict[str, str] = dict(_DEFAULT_IO_FUNCTIONS)
+HELPER_INTERNAL_CALLS: dict[str, set[str]] = {k: set(v) for k, v in _DEFAULT_HELPER_INTERNAL_CALLS.items()}
+IO_INTERNAL_CALLS: dict[str, set[str]] = {k: set(v) for k, v in _DEFAULT_IO_INTERNAL_CALLS.items()}
+
+# Merge project-specific configuration from pyproject.toml
+_load_test_isolation_config()
+
 # subprocess functions that the runtime audit wraps.
 _SUBPROCESS_FUNCS = ("run", "call", "check_call", "check_output", "Popen")