fix: isolate the real commit-check subprocess from repo and org config

The previous commit worked around one symptom (no git identity ->
commit-check falls back to HEAD's author -> ignore_authors matches a
bot -> the piped message check silently skips) by giving the test
step a git identity in CI. That leaves TestRealCommitCheckBinary
coupled to more than it should be about: it still runs from this
repo's checkout, so it still picks up commit-check.toml, which still
inherits the org's shared config over the network on every test run,
and it still resolves ignore_authors and every other repo-level
setting -- none of which the test's own docstring says it is about.

Run it from an isolated, empty directory instead. commit-check reads
cchk.toml/commit-check.toml only from its cwd (no upward search), so
an empty cwd gets the built-in defaults on their own: no config file,
no network fetch, no ignore_authors, and -- since git commands run
from a non-repository directory return nothing -- no HEAD author to
fall back to either. The test now only exercises what it says it
exercises: the CLI's JSON contract for a piped message.

This supersedes the git-identity workaround, which is no longer
needed and is reverted here.

Author: shenxianpeng

.github/workflows/coverage.yml

@@ -18,13 +18,6 @@ jobs:
         with:
           # 3.10 is the real floor, see test.yml
           python-version: "3.10"
-      # See test.yml: TestRealCommitCheckBinary needs a non-ignored git
-      # identity, or commit-check falls back to HEAD's own author (e.g.
-      # dependabot[bot] on a dependency-bump PR) and silently skips.
-      - name: Configure a git identity for the test suite
-        run: |
-          git config --global user.name "github-actions[bot]"
-          git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
       - name: Install dependencies
         run: |
           pip install -r requirements.txt

.github/workflows/test.yml

@@ -31,18 +31,6 @@ jobs:
         with:
           python-version: ${{ matrix.py }}
 
-      # actions/checkout sets no git identity. TestRealCommitCheckBinary pipes
-      # a message to the real commit-check binary, unset from any commit --
-      # with no local user.name, commit-check falls back to the checked-out
-      # HEAD commit's own author to test against ignore_authors. On a
-      # Dependabot PR that author is "dependabot[bot]", which the org's
-      # inherited config ignores, so the check silently skips instead of
-      # running. A neutral identity keeps the test about the piped message.
-      - name: Configure a git identity for the test suite
-        run: |
-          git config --global user.name "github-actions[bot]"
-          git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
-
       - name: Install dependencies
         run: |
           python -m pip install --upgrade pip

main.py

@@ -511,7 +511,7 @@ def _relay_cli_notices(text: str) -> None:
 
 
 def run_check_json(
-    args: list[str], input_text: str | None = None
+    args: list[str], input_text: str | None = None, cwd: str | None = None
 ) -> tuple[int, dict[str, Any] | None, str]:
     """Run ``commit-check --format json`` and return (exit code, parsed JSON, raw output).
 
@@ -526,6 +526,12 @@ def run_check_json(
     The parsed JSON is ``None`` when the CLI did not produce valid JSON; the
     raw output is kept so callers can fall back to showing it as text, and
     in that case it carries both streams so nothing the CLI said is lost.
+
+    ``cwd`` picks the directory the CLI runs from -- left at ``None`` (the
+    caller's own cwd) for the real action, where that directory is the
+    checked-out repository on purpose. A caller that wants no config file,
+    no ``ignore_authors``, and no ``git`` state to leak in (the unmocked
+    binary test, notably) passes an isolated directory instead.
     """
     command = ["commit-check", "--format", "json"] + args
     result = subprocess.run(
@@ -536,6 +542,7 @@ def run_check_json(
         text=True,
         encoding="utf-8",
         check=False,
+        cwd=cwd,
     )
     out = result.stdout or ""
     err = result.stderr or ""

main_test.py

@@ -2800,10 +2800,29 @@ class TestRealCommitCheckBinary(unittest.TestCase):
     for every value. This is the one place that drift can fail a build. CI
     installs requirements.txt, so the binary is always present there; the
     skip only spares a contributor running the suite without it.
+
+    Run from an isolated, empty directory rather than the checked-out repo:
+    this repo's own ``commit-check.toml`` inherits the org's shared config
+    over the network, and a message piped in here is deliberately unrelated
+    to any real commit, so neither that config nor ``git``'s notion of the
+    current author (nor, through it, ``ignore_authors``) belongs in a test
+    about the CLI's JSON contract. A previous version of this test ran from
+    the repo as checked out, so it inherited both -- and, having no git
+    identity of its own, additionally fell back to HEAD's actual author to
+    weigh against ``ignore_authors``. On a Dependabot PR that author is
+    ``dependabot[bot]``, which the org config ignores, so the message check
+    silently skipped instead of running, regardless of the message.
     """
 
+    def setUp(self):
+        tmpdir = tempfile.TemporaryDirectory()
+        self.addCleanup(tmpdir.cleanup)
+        self._cwd = tmpdir.name
+
     def _run(self, message: str) -> tuple[int, dict]:
-        rc, data, raw = main.run_check_json(["--message"], input_text=message)
+        rc, data, raw = main.run_check_json(
+            ["--message"], input_text=message, cwd=self._cwd
+        )
         self.assertIsInstance(data, dict, f"CLI did not emit JSON:\n{raw}")
         assert data is not None  # for the type checker; asserted above
         self.assertIn("checks", data)