CI: share test helpers in 17 more test files (#824)

crates/socket-patch-cli/tests/apply/apply_network.rs

@@ -10,29 +10,16 @@
 //!   - `apply` against installed packages writes patched content to
 //!     node_modules and leaves `.socket/` byte-identical.
 
-use std::path::{Path, PathBuf};
+use std::path::Path;
 use std::process::Command;
 
-use sha2::{Digest, Sha256};
 use wiremock::matchers::{method, path};
 use wiremock::{Mock, MockServer, ResponseTemplate};
 
-fn binary() -> PathBuf {
-    env!("CARGO_BIN_EXE_socket-patch").into()
-}
+use crate::common::{binary, git_sha256};
 
 const ORG_SLUG: &str = "test-org";
 
-/// Git-SHA256: SHA256("blob <len>\0" ++ content). Matches the binary's
-/// content-addressable hashing.
-fn git_sha256(content: &[u8]) -> String {
-    let header = format!("blob {}\0", content.len());
-    let mut hasher = Sha256::new();
-    hasher.update(header.as_bytes());
-    hasher.update(content);
-    hex::encode(hasher.finalize())
-}
-
 fn write_npm_package(root: &Path, name: &str, version: &str, file_path: &str, file_content: &[u8]) {
     let pkg_dir = root.join("node_modules").join(name);
     std::fs::create_dir_all(&pkg_dir).expect("create pkg dir");

crates/socket-patch-cli/tests/cli/api_client_errors_e2e.rs

@@ -5,14 +5,12 @@
 //! (`status`/`error`) on stdout, so a regression that turns a real API
 //! failure into a fake success fails loudly.
 
-use std::path::{Path, PathBuf};
+use std::path::Path;
 
 use wiremock::matchers::{method, path};
 use wiremock::{Mock, MockServer, ResponseTemplate};
 
-fn binary() -> PathBuf {
-    env!("CARGO_BIN_EXE_socket-patch").into()
-}
+use crate::common::binary;
 
 const ORG_SLUG: &str = "test-org";
 const UUID: &str = "11111111-1111-4111-8111-111111111111";

crates/socket-patch-cli/tests/cli/shared_helper_copies.rs

@@ -14,28 +14,10 @@ use std::path::Path;
 /// a stale entry is not an error, so a PR that migrates one never turns
 /// another red.
 const PENDING_PRIVATE_HELPERS: &[&str] = &[
-    "apply/apply_network.rs",
-    "cli/api_client_errors_e2e.rs",
-    "diff_created_file_e2e.rs",
-    "e2e_vex_vendor.rs",
-    "in_process_agent_reapply.rs",
-    "in_process_alternate_installers.rs",
-    "in_process_cargo_apply.rs",
-    "in_process_edge_cases.rs",
-    "in_process_gem_apply.rs",
-    "in_process_gem_multi_platform.rs",
-    "in_process_get_manifest_path.rs",
-    "in_process_pypi_apply.rs",
-    "in_process_pypi_multi_release.rs",
-    "in_process_remote_ecosystems_apply.rs",
-    "in_process_remove_repair_lifecycle.rs",
-    "remove_rollback_api_overrides.rs",
     "repair/covgap_commands_repair.rs",
     "repair/covgap_commands_repair_vendor.rs",
     "repair/repair_invariants.rs",
-    "rollback/rollback_multicopy_blob_gate.rs",
     "scan/covgap_commands_fetch_stage.rs",
-    "scan_vendor_e2e.rs",
     "vex_e2e_common/mod.rs",
     "vlt_e2e_common/mod.rs",
     "vlt_hosted_common/mod.rs",

crates/socket-patch-cli/tests/e2e_vex_vendor.rs

@@ -39,9 +39,9 @@ use socket_patch_core::vendor::state::{
 /// the uuid path level, so fixtures must use the real shape.
 const UUID: &str = "9f6b2c4e-1d3a-4f6b-8c2d-7e5a9b1c3d5f";
 
-fn binary() -> &'static str {
-    env!("CARGO_BIN_EXE_socket-patch")
-}
+#[path = "common/mod.rs"]
+mod common;
+use common::binary;
 
 /// CLI invocation with the ambient `SOCKET_*` environment scrubbed (same
 /// rationale as `e2e_vex.rs`: explicit flags must be the sole source of

crates/socket-patch-cli/tests/in_process_agent_reapply.rs

@@ -11,7 +11,6 @@
 use std::path::Path;
 
 use serial_test::serial;
-use sha2::{Digest, Sha256};
 use socket_patch_cli::commands::get::{run as get_run, GetArgs};
 use socket_patch_cli::commands::scan::{run as scan_run, ScanArgs, ScanMode};
 use wiremock::matchers::{method, path, path_regex};
@@ -25,12 +24,9 @@ const UUID: &str = "45445445-4544-4544-8544-454454454454";
 const ORIGINAL: &[u8] = b"module.exports = 'original';\n";
 const PATCHED: &[u8] = b"module.exports = 'patched';\n";
 
-fn git_sha256(content: &[u8]) -> String {
-    let mut hasher = Sha256::new();
-    hasher.update(format!("blob {}\0", content.len()).as_bytes());
-    hasher.update(content);
-    hex::encode(hasher.finalize())
-}
+#[path = "common/mod.rs"]
+mod common;
+use common::git_sha256;
 
 fn common(cwd: &Path, server: &MockServer) -> socket_patch_cli::args::GlobalArgs {
     socket_patch_cli::args::GlobalArgs {

crates/socket-patch-cli/tests/in_process_alternate_installers.rs

@@ -9,19 +9,11 @@ use std::path::{Path, PathBuf};
 use std::process::Command;
 
 use serial_test::serial;
-use sha2::{Digest, Sha256};
 use socket_patch_cli::commands::apply::{run as apply_run, ApplyArgs};
 
-#[path = "common/cache_env.rs"]
-mod cache_env;
-
-fn git_sha256(content: &[u8]) -> String {
-    let header = format!("blob {}\0", content.len());
-    let mut hasher = Sha256::new();
-    hasher.update(header.as_bytes());
-    hasher.update(content);
-    hex::encode(hasher.finalize())
-}
+#[path = "common/mod.rs"]
+mod common;
+use common::{cache_env, git_sha256};
 
 /// Strong oracle: the file at `path` must now contain EXACTLY the expected
 /// patched bytes, its git-sha256 must equal the manifest's afterHash, and

crates/socket-patch-cli/tests/in_process_cargo_apply.rs

@@ -9,7 +9,6 @@ use std::process::Command;
 
 use base64::Engine;
 use serial_test::serial;
-use sha2::{Digest, Sha256};
 use socket_patch_cli::commands::scan::{run as scan_run, ScanArgs};
 use wiremock::matchers::{method, path, path_regex};
 use wiremock::{Mock, MockServer, ResponseTemplate};
@@ -19,13 +18,9 @@ const UUID: &str = "14141414-1414-4141-8141-141414141414";
 const CRATE_NAME: &str = "cfg-if";
 const CRATE_VERSION: &str = "1.0.0";
 
-fn git_sha256(content: &[u8]) -> String {
-    let header = format!("blob {}\0", content.len());
-    let mut hasher = Sha256::new();
-    hasher.update(header.as_bytes());
-    hasher.update(content);
-    hex::encode(hasher.finalize())
-}
+#[path = "common/mod.rs"]
+mod common;
+use common::git_sha256;
 
 fn has_cargo() -> bool {
     Command::new("cargo")

crates/socket-patch-cli/tests/in_process_edge_cases.rs

@@ -8,17 +8,12 @@
 use std::path::Path;
 
 use serial_test::serial;
-use sha2::{Digest, Sha256};
 use socket_patch_cli::commands::apply::{run as apply_run, ApplyArgs};
 use socket_patch_cli::commands::rollback::{run as rollback_run, RollbackArgs};
 
-fn git_sha256(content: &[u8]) -> String {
-    let header = format!("blob {}\0", content.len());
-    let mut hasher = Sha256::new();
-    hasher.update(header.as_bytes());
-    hasher.update(content);
-    hex::encode(hasher.finalize())
-}
+#[path = "common/mod.rs"]
+mod common;
+use common::git_sha256;
 
 /// Identity fingerprint of a file that survives a byte-identical rewrite check.
 ///

crates/socket-patch-cli/tests/in_process_gem_apply.rs

@@ -9,26 +9,18 @@ use std::process::Command;
 
 use base64::Engine;
 use serial_test::serial;
-use sha2::{Digest, Sha256};
 use socket_patch_cli::commands::scan::{run as scan_run, ScanArgs};
 use wiremock::matchers::{method, path, path_regex};
 use wiremock::{Mock, MockServer, ResponseTemplate};
 
-#[path = "common/cache_env.rs"]
-mod cache_env;
-
 const ORG: &str = "test-org";
 const UUID: &str = "13131313-1313-4131-8131-131313131313";
 const GEM_NAME: &str = "colorize";
 const GEM_VERSION: &str = "1.1.0";
 
-fn git_sha256(content: &[u8]) -> String {
-    let header = format!("blob {}\0", content.len());
-    let mut hasher = Sha256::new();
-    hasher.update(header.as_bytes());
-    hasher.update(content);
-    hex::encode(hasher.finalize())
-}
+#[path = "common/mod.rs"]
+mod common;
+use common::{cache_env, git_sha256};
 
 fn has_gem() -> bool {
     Command::new("gem")

crates/socket-patch-cli/tests/in_process_gem_multi_platform.rs

@@ -27,7 +27,6 @@ use std::path::{Path, PathBuf};
 
 use base64::Engine;
 use serial_test::serial;
-use sha2::{Digest, Sha256};
 use socket_patch_cli::commands::remove::{run as remove_run, RemoveArgs};
 use socket_patch_cli::commands::rollback::{run as rollback_run, RollbackArgs};
 use socket_patch_cli::commands::scan::{run as scan_run, ScanArgs};
@@ -69,13 +68,9 @@ fn darwin_after_bytes() -> Vec<u8> {
     p
 }
 
-fn git_sha256(content: &[u8]) -> String {
-    let header = format!("blob {}\0", content.len());
-    let mut hasher = Sha256::new();
-    hasher.update(header.as_bytes());
-    hasher.update(content);
-    hex::encode(hasher.finalize())
-}
+#[path = "common/mod.rs"]
+mod common;
+use common::git_sha256;
 
 fn b64(bytes: &[u8]) -> String {
     base64::engine::general_purpose::STANDARD.encode(bytes)

crates/socket-patch-cli/tests/in_process_get_manifest_path.rs

@@ -30,7 +30,6 @@
 use std::path::Path;
 
 use serial_test::serial;
-use sha2::{Digest, Sha256};
 use socket_patch_cli::args::GlobalArgs;
 use socket_patch_cli::commands::get::{run, GetArgs};
 use wiremock::matchers::{method, path, path_regex};
@@ -46,14 +45,9 @@ const PATCHED: &[u8] = b"patched\n";
 const PATCHED_B64: &str = "cGF0Y2hlZAo=";
 const ORIGINAL_B64: &str = "b3JpZ2luYWwK";
 
-/// Git-blob-style sha256 — the hash shape apply verifies against.
-fn git_sha256(content: &[u8]) -> String {
-    let header = format!("blob {}\0", content.len());
-    let mut hasher = Sha256::new();
-    hasher.update(header.as_bytes());
-    hasher.update(content);
-    hex::encode(hasher.finalize())
-}
+#[path = "common/mod.rs"]
+mod common;
+use common::git_sha256;
 
 /// Mount the patch-view endpoint for `UUID`/`PURL` with real (git-blob)
 /// hashes so the nested apply can verify and patch. Returns `after_hash`.

crates/socket-patch-cli/tests/in_process_pypi_apply.rs

@@ -13,7 +13,6 @@ use std::process::Command;
 
 use base64::Engine;
 use serial_test::serial;
-use sha2::{Digest, Sha256};
 use socket_patch_cli::commands::apply::{run as apply_run, ApplyArgs};
 use socket_patch_cli::commands::scan::{run as scan_run, ScanArgs};
 use wiremock::matchers::{method, path, path_regex};
@@ -24,13 +23,9 @@ const UUID: &str = "12121212-1212-4121-8121-121212121212";
 const PYPI_PACKAGE: &str = "six";
 const PYPI_VERSION: &str = "1.16.0";
 
-fn git_sha256(content: &[u8]) -> String {
-    let header = format!("blob {}\0", content.len());
-    let mut hasher = Sha256::new();
-    hasher.update(header.as_bytes());
-    hasher.update(content);
-    hex::encode(hasher.finalize())
-}
+#[path = "common/mod.rs"]
+mod common;
+use common::git_sha256;
 
 /// Resolve an available Python executable. Tries `python3` (Unix
 /// convention) first, then `python` (the canonical Windows name —

crates/socket-patch-cli/tests/in_process_pypi_multi_release.rs

@@ -23,7 +23,6 @@ use std::process::Command;
 
 use base64::Engine;
 use serial_test::serial;
-use sha2::{Digest, Sha256};
 use socket_patch_cli::commands::remove::{run as remove_run, RemoveArgs};
 use socket_patch_cli::commands::rollback::{run as rollback_run, RollbackArgs};
 use socket_patch_cli::commands::scan::{run as scan_run, ScanArgs};
@@ -46,13 +45,9 @@ const ARTIFACT_SDIST: &str = "sdist";
 
 const MARKER_INSTALLED: &[u8] = b"\n# SOCKET-MULTIRELEASE-INSTALLED\n";
 
-fn git_sha256(content: &[u8]) -> String {
-    let header = format!("blob {}\0", content.len());
-    let mut hasher = Sha256::new();
-    hasher.update(header.as_bytes());
-    hasher.update(content);
-    hex::encode(hasher.finalize())
-}
+#[path = "common/mod.rs"]
+mod common;
+use common::git_sha256;
 
 fn b64(bytes: &[u8]) -> String {
     base64::engine::general_purpose::STANDARD.encode(bytes)

crates/socket-patch-cli/tests/in_process_remote_ecosystems_apply.rs

@@ -17,7 +17,6 @@ use std::path::{Path, PathBuf};
 
 use base64::Engine;
 use serial_test::serial;
-use sha2::{Digest, Sha256};
 use socket_patch_cli::commands::scan::{run as scan_run, ScanArgs};
 use wiremock::matchers::{method, path, path_regex};
 use wiremock::{Mock, MockServer, ResponseTemplate};
@@ -67,13 +66,9 @@ impl Drop for NoJvmCaches {
     }
 }
 
-fn git_sha256(content: &[u8]) -> String {
-    let header = format!("blob {}\0", content.len());
-    let mut hasher = Sha256::new();
-    hasher.update(header.as_bytes());
-    hasher.update(content);
-    hex::encode(hasher.finalize())
-}
+#[path = "common/mod.rs"]
+mod common;
+use common::git_sha256;
 
 // --- Request introspection helpers -----------------------------------------
 // Exit 0 is also what a crawler that discovered nothing (or short-circuited

crates/socket-patch-cli/tests/in_process_remove_repair_lifecycle.rs

@@ -11,21 +11,16 @@ mod prebuilt_common;
 use std::path::Path;
 
 use serial_test::serial;
-use sha2::{Digest, Sha256};
 use socket_patch_cli::commands::remove::{run as remove_run, RemoveArgs};
 use socket_patch_cli::commands::repair::{run as repair_run, RepairArgs};
 use wiremock::matchers::{method, path};
 use wiremock::{Mock, MockServer, ResponseTemplate};
 
 const ORG: &str = "test-org";
 
-fn git_sha256(content: &[u8]) -> String {
-    let header = format!("blob {}\0", content.len());
-    let mut hasher = Sha256::new();
-    hasher.update(header.as_bytes());
-    hasher.update(content);
-    hex::encode(hasher.finalize())
-}
+#[path = "common/mod.rs"]
+mod common;
+use common::git_sha256;
 
 fn write_root(cwd: &Path) {
     std::fs::write(

crates/socket-patch-cli/tests/remove_rollback_api_overrides.rs

@@ -18,15 +18,12 @@
 
 use std::io::{Read, Write};
 use std::net::TcpListener;
-use std::path::PathBuf;
 use std::process::Command;
 use std::sync::{Arc, Mutex};
 
-use sha2::{Digest, Sha256};
-
-fn binary() -> PathBuf {
-    env!("CARGO_BIN_EXE_socket-patch").into()
-}
+#[path = "common/mod.rs"]
+mod common;
+use common::{binary, git_sha256};
 
 /// Every `SOCKET_*` env var `GlobalArgs` reads as a flag fallback — scrubbed
 /// so behavior is driven only by the explicit flags under test (an ambient
@@ -75,15 +72,6 @@ fn env_scrub_covers_every_global_arg_env_var() {
     }
 }
 
-/// Git-SHA256: SHA256("blob <len>\0" ++ content).
-fn git_sha256(content: &[u8]) -> String {
-    let header = format!("blob {}\0", content.len());
-    let mut hasher = Sha256::new();
-    hasher.update(header.as_bytes());
-    hasher.update(content);
-    hex::encode(hasher.finalize())
-}
-
 /// Minimal HTTP stub playing the authenticated API: serves `blob` bytes at
 /// any path ending in `/patches/blob/<hash>`, 404 otherwise, and records
 /// every request path. The accept thread is detached; it dies with the test