refactor(auth): read the environment through the funnel

[sileht]

mergify-auth landed while this stack was in flight and its
production side already reads through mergify_core::env, since
var_non_empty predates the funnel. Only its tests were left:
machine's COMPUTERNAME / HOSTNAME chain, browser's
SSH_CONNECTION / DISPLAY / WAYLAND_DISPLAY probes, and
with_mergify_token.

They install an overlay now, like everywhere else, so the crate
stops mutating the process environment and drops its temp-env
dependency. with_mergify_token keeps its shape: the overlay is on
this thread and the current_thread runtime it builds drives the
future on that same thread, so the closure form still works and no
call site changes.

Co-Authored-By: Claude Opus 5 noreply@anthropic.com

[sileht]

This pull request is part of a Mergify stack:

#	Pull Request	Link
1	refactor(tui): resolve the color env overrides at the CLI entry point	#1837
2	feat(core): read the environment through one funnel, with a hermetic test overlay	#1838
3	refactor(ci): read the CI environment through the funnel	#1839
4	refactor(stack): read the environment through the funnel	#1840
5	refactor(cli): assert the clap env hook is absent without mutating the environment	#1841
6	refactor(auth): read the environment through the funnel	#1842	👈
7	chore(lint): make the next process-environment read fail the build	#1843

[mergify]

Merge Protections

🔴 3 of 7 protections blocking · waiting on 👀 reviews and ⛓️ dependency

	Protection	Waiting on
🔴	⛓️ Depends-On Requirements	⛓️ dependency
🔴	👀 Review Requirements	👀 reviews
🔴	🔎 Reviews	👀 reviews
🟢	🤖 Continuous Integration	—
🟢	Enforce conventional commit	—
🟢	📕 PR description	—
🟢	🚦 Auto-queue	—

🔴 ⛓️ Depends-On Requirements

Waiting for

• depends-on=Mergifyio/mergify-cli#1837 [⛓️ refactor(tui): resolve the color env overrides at the CLI entry point #1837 [stack]]
• depends-on=Mergifyio/mergify-cli#1838 [⛓️ feat(core): read the environment through one funnel, with a hermetic test overlay #1838 [stack]]
• depends-on=Mergifyio/mergify-cli#1839 [⛓️ refactor(ci): read the CI environment through the funnel #1839 [stack]]
• depends-on=Mergifyio/mergify-cli#1840 [⛓️ refactor(stack): read the environment through the funnel #1840 [stack]]
• depends-on=Mergifyio/mergify-cli#1841 [⛓️ refactor(cli): assert the clap env hook is absent without mutating the environment #1841 [stack]]

This rule is failing.

Requirement based on the presence of Depends-On in the body of the pull request

• depends-on=Mergifyio/mergify-cli#1837 [⛓️ refactor(tui): resolve the color env overrides at the CLI entry point #1837 [stack]]
• depends-on=Mergifyio/mergify-cli#1838 [⛓️ feat(core): read the environment through one funnel, with a hermetic test overlay #1838 [stack]]
• depends-on=Mergifyio/mergify-cli#1839 [⛓️ refactor(ci): read the CI environment through the funnel #1839 [stack]]
• depends-on=Mergifyio/mergify-cli#1840 [⛓️ refactor(stack): read the environment through the funnel #1840 [stack]]
• depends-on=Mergifyio/mergify-cli#1841 [⛓️ refactor(cli): assert the clap env hook is absent without mutating the environment #1841 [stack]]

🔴 👀 Review Requirements

Waiting for

• #approved-reviews-by>=2

This rule is failing.

• any of:
  • #approved-reviews-by>=2
  • author = dependabot[bot]
  • author = mergify-ci-bot
  • author = renovate[bot]

🔴 🔎 Reviews

Waiting for

• #review-requested = 0

This rule is failing.

• #review-requested = 0
• #changes-requested-reviews-by = 0
• #review-threads-unresolved = 0

---

Show 4 satisfied protections

🟢 🤖 Continuous Integration

• all of:
  • check-success=ci-gate

🟢 Enforce conventional commit

Make sure that we follow https://www.conventionalcommits.org/en/v1.0.0/

• title ~= ^(fix|feat|internal|docs|style|refactor|perf|test|build|ci|chore|revert|ui)(?:\(.+\))?!?:

🟢 📕 PR description

• body ~= (?ms:.{48,})

🟢 🚦 Auto-queue

When all merge protections are satisfied, this pull request will be queued automatically.

[sileht]

Revision history

#	Type	Changes	Reason	Date
1	initial	c53311d		2026-09-18 07:38 UTC
2	rebase	c53311d → 2de27ff (rebase only)		2026-09-18 07:38 UTC
3	rebase	2de27ff → 6c614fe (rebase only)		2026-09-18 08:13 UTC

[Copilot]

🟢 Approval recommended

No blocking issues were identified; the remaining comment is a minor cleanup nit.

Pull request overview

Refactors mergify-auth tests to use thread-local environment overlays instead of mutating process environment state.

Changes:

• Migrates machine, browser, and token tests to environment overlays.
• Preserves current-thread async token test behavior.
• Removes the crate-level temp-env dependency and lockfile entry.

File summaries

File	Description
crates/mergify-auth/src/machine.rs	Uses overlays for hostname tests.
crates/mergify-auth/src/lib.rs	Updates token-dependent async tests.
crates/mergify-auth/src/browser.rs	Uses overlays for browser environment tests.
crates/mergify-auth/Cargo.toml	Removes the direct temp-env dependency.
Cargo.lock	Removes the unused package entry.

Review details

Suppressed comments (1)

crates/mergify-auth/Cargo.toml:27

• The crate-level dependency is removed, but temp-env = "0.3" is still declared in the workspace dependency table at Cargo.toml:75, and this is now the only repository reference to it. Please remove the unused workspace entry as part of dropping this dependency so the workspace manifest does not retain dead dependency configuration.

serde_json = { workspace = true }

• Files reviewed: 4/5 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.