Skip to content

Support authentication/URI optipns for Mongo - cloeses #747#828

Draft
fizyk wants to merge 2 commits into
mainfrom
issue-747
Draft

Support authentication/URI optipns for Mongo - cloeses #747#828
fizyk wants to merge 2 commits into
mainfrom
issue-747

Conversation

@fizyk

@fizyk fizyk commented Jun 27, 2026

Copy link
Copy Markdown
Member

Summary by CodeRabbit

  • New Features

    • Added support for authenticated MongoDB connections, including username/password, auth source, TLS, and full connection URI options.
    • MongoDB fixtures can now start an authenticated server or connect to an existing authenticated instance.
  • Tests

    • Added authentication coverage for both process-managed and external MongoDB setups.
    • Added CI runs for auth-enabled MongoDB with coverage reports for serial and parallel test execution.
  • Documentation

    • Updated configuration help and usage notes for the new connection options.

@coderabbitai

coderabbitai Bot commented Jun 27, 2026

Copy link
Copy Markdown

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 851797e6-19c8-43a4-bf5c-ed27c647f444

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch issue-747

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 9

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/tests-auth.yml:
- Line 28: The checkout step in the tests-auth workflow is leaving the default
GitHub token persisted in git config before the test code runs. Update the
actions/checkout usage in the workflow to disable credential persistence with
persist-credentials set to false so the PR code cannot read the token during the
test job.

In `@newsfragments/747.feature.rst`:
- Line 1: Trim the release note to match the actual mongo_proc API that shipped:
mongo_proc accepts username, password, and auth_source, but not tls, and it
forces mongo_executor.tls to False. Update the fragment text to describe only
the supported mongo_proc authentication behavior and avoid mentioning
mongo_noproc or any tls support so the CHANGES.rst entry does not advertise an
unavailable capability.

In `@pytest_mongo/config.py`:
- Line 46: The TLS option handling in config.py is coercing the value through
get_mongo_option(), which drops an explicit falsey CLI override like
--no-mongo-tls and lets the ini setting win. Update the Mongo TLS wiring so the
config path preserves explicit False values, and adjust the paired boolean CLI
option definitions to default to None instead of False so omitted flags still
fall back to ini values. Use the existing get_mongo_option() call site and the
Mongo config/CLI option declarations as the place to fix this behavior.

In `@pytest_mongo/executor_noop.py`:
- Around line 45-46: NoopExecutor._make_client currently returns a MongoClient
for self.uri without passing through self.tls, so URI-based clients can ignore
the TLS setting. Update the self.uri branch in NoopExecutor._make_client to
forward the tls flag from self.tls when constructing MongoClient, ensuring
mongo_uri and mongo_tls stay in sync. Keep the change localized to
NoopExecutor._make_client and preserve the existing non-URI client path.

In `@pytest_mongo/factories/client.py`:
- Around line 47-48: The MongoDB client creation path in client.py ignores the
TLS flag when mongo_uri is provided, so the URI-based branch in the MongoClient
setup must pass through mongo_tls as well. Update the mongo_uri branch in the
client factory logic that creates MongoClient so it threads the TLS option
consistently with the non-URI path, keeping the behavior aligned regardless of
whether the connection comes from a URI or individual settings.

In `@pytest_mongo/factories/process.py`:
- Around line 34-38: The user creation in the process factory is assigning the
built-in root role against the configurable auth_source database, which can be
wrong for non-admin setups. Update the createUser call in the process setup code
to always grant the root role from admin, while keeping auth_source only for the
authentication database used by the command. Use the createUser logic in
process.py as the place to fix this and ensure the role definition references
admin explicitly.
- Line 156: The process-backed Mongo setup is overwriting TLS on the executor,
so configured TLS never takes effect. Update the process client setup in the
`mongo_executor` / `mongo_proc` path to preserve the TLS setting from `params`
instead of forcing `mongo_executor.tls` to False, and make sure the factory
logic in `process.py` passes the configured TLS state through consistently.

In `@pytest_mongo/plugin.py`:
- Around line 119-130: The paired TLS options in plugin.py currently use a
boolean default that makes omitted and explicit false indistinguishable, which
breaks the shared config fallback and prevents --no-mongo-tls from reliably
overriding ini settings. Update the argparse setup in the option registration
logic for mongo_tls so both addoption calls use an unset sentinel default
(default=None), and apply the same pattern to any other paired boolean flags in
this plugin that rely on config fallbacks.

In `@tests/test_auth.py`:
- Around line 42-43: Register xdist_group as a recognized pytest marker in the
test configuration so serial runs stop emitting PytestUnknownMarkWarning. Update
the pytest marker list in the shared test setup used by tests/test_auth.py and
the other xdist_group usages, ensuring the marker is declared consistently for
the whole suite.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 6cc70448-d250-430b-a660-e6112499c251

📥 Commits

Reviewing files that changed from the base of the PR and between 6a3085a and a4c86e0.

📒 Files selected for processing (10)
  • .github/workflows/tests-auth.yml
  • newsfragments/747.feature.rst
  • pytest_mongo/config.py
  • pytest_mongo/executor_noop.py
  • pytest_mongo/factories/client.py
  • pytest_mongo/factories/noprocess.py
  • pytest_mongo/factories/process.py
  • pytest_mongo/plugin.py
  • tests/conftest.py
  • tests/test_auth.py

--health-retries 5

steps:
- uses: actions/checkout@v7

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Disable checkout credential persistence before the PR code runs.

This job checks out the branch and then executes its test suite. Leaving the default actions/checkout token in git config gives that code an avoidable path to read it; set persist-credentials: false.

Suggested fix
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@v7
+      with:
+        persist-credentials: false
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
- uses: actions/checkout@v7
- uses: actions/checkout@v7
with:
persist-credentials: false
🧰 Tools
🪛 zizmor (1.26.1)

[warning] 28-28: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/tests-auth.yml at line 28, The checkout step in the
tests-auth workflow is leaving the default GitHub token persisted in git config
before the test code runs. Update the actions/checkout usage in the workflow to
disable credential persistence with persist-credentials set to false so the PR
code cannot read the token during the test job.

Source: Linters/SAST tools

@@ -0,0 +1 @@
Add authentication support to ``mongo_noproc`` and ``mongo_proc``: both factories now accept ``username``, ``password``, ``auth_source``, and ``tls`` parameters. ``mongo_noproc`` additionally accepts a full ``uri``. When ``username`` is provided to ``mongo_proc``, mongod is started with ``--auth`` and the user is created via the localhost exception. All parameters can also be set via ini options (``mongo_username``, ``mongo_password``, ``mongo_auth_source``, ``mongo_uri``, ``mongo_tls``) or the corresponding CLI flags.

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win

Trim the fragment to the mongo_proc API that actually landed.

The provided mongo_proc() implementation accepts username, password, and auth_source, but not tls; it also hard-codes mongo_executor.tls = False. As written, this fragment would publish a mongo_proc capability users cannot call. As per path instructions, the content should be suitable for inclusion in CHANGES.rst.

Suggested wording
-Add authentication support to ``mongo_noproc`` and ``mongo_proc``: both factories now accept ``username``, ``password``, ``auth_source``, and ``tls`` parameters. ``mongo_noproc`` additionally accepts a full ``uri``. When ``username`` is provided to ``mongo_proc``, mongod is started with ``--auth`` and the user is created via the localhost exception. All parameters can also be set via ini options (``mongo_username``, ``mongo_password``, ``mongo_auth_source``, ``mongo_uri``, ``mongo_tls``) or the corresponding CLI flags.
+Add authentication support to ``mongo_proc`` and ``mongo_noproc`` via ``username``, ``password``, and ``auth_source``. ``mongo_noproc`` additionally accepts ``tls`` and a full ``uri``. When ``username`` is provided to ``mongo_proc``, ``mongod`` is started with ``--auth`` and the user is created via the localhost exception. Matching ini options and CLI flags are available where supported.
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
Add authentication support to ``mongo_noproc`` and ``mongo_proc``: both factories now accept ``username``, ``password``, ``auth_source``, and ``tls`` parameters. ``mongo_noproc`` additionally accepts a full ``uri``. When ``username`` is provided to ``mongo_proc``, mongod is started with ``--auth`` and the user is created via the localhost exception. All parameters can also be set via ini options (``mongo_username``, ``mongo_password``, ``mongo_auth_source``, ``mongo_uri``, ``mongo_tls``) or the corresponding CLI flags.
Add authentication support to ``mongo_proc`` and ``mongo_noproc`` via ``username``, ``password``, and ``auth_source``. ``mongo_noproc`` additionally accepts ``tls`` and a full ``uri``. When ``username`` is provided to ``mongo_proc``, ``mongod`` is started with ``--auth`` and the user is created via the localhost exception. Matching ini options and CLI flags are available where supported.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@newsfragments/747.feature.rst` at line 1, Trim the release note to match the
actual mongo_proc API that shipped: mongo_proc accepts username, password, and
auth_source, but not tls, and it forces mongo_executor.tls to False. Update the
fragment text to describe only the supported mongo_proc authentication behavior
and avoid mentioning mongo_noproc or any tls support so the CHANGES.rst entry
does not advertise an unavailable capability.

Source: Path instructions

Comment thread pytest_mongo/config.py
password=get_mongo_option("password") or None,
auth_source=get_mongo_option("auth_source") or None,
uri=get_mongo_option("uri") or None,
tls=bool(get_mongo_option("tls")),

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

Preserve explicit False for TLS overrides.

get_mongo_option() falls back to ini values whenever the CLI value is falsey, so --no-mongo-tls cannot override mongo_tls = true.

Proposed fix
     def get_mongo_option(option: str) -> Any:
         name = "mongo_" + option
-        return request.config.getoption(name) or request.config.getini(name)
+        cli_value = request.config.getoption(name)
+        return cli_value if cli_value is not None else request.config.getini(name)

This also requires the paired boolean CLI flags to default to None, otherwise ini values will be ignored when the flag is omitted.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@pytest_mongo/config.py` at line 46, The TLS option handling in config.py is
coercing the value through get_mongo_option(), which drops an explicit falsey
CLI override like --no-mongo-tls and lets the ini setting win. Update the Mongo
TLS wiring so the config path preserves explicit False values, and adjust the
paired boolean CLI option definitions to default to None instead of False so
omitted flags still fall back to ini values. Use the existing get_mongo_option()
call site and the Mongo config/CLI option declarations as the place to fix this
behavior.

Comment thread pytest_mongo/executor.py
Comment on lines +45 to +46
if self.uri:
return MongoClient(self.uri)

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Verify URI+TLS paths and tests are covered.
rg -n 'MongoClient\(.*uri|mongo_uri|mongo_tls|tls=' pytest_mongo tests

Repository: dbfixtures/pytest-mongo

Length of output: 1399


🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Inspect the noop executor and its related callers/tests.
sed -n '1,140p' pytest_mongo/executor_noop.py
printf '\n---\n'
sed -n '1,160p' pytest_mongo/factories/client.py
printf '\n---\n'
sed -n '1,140p' pytest_mongo/config.py
printf '\n---\n'
rg -n -A3 -B3 'executor_noop|MongoClient\(self\.uri\)|tls=self\.tls|mongo_tls|mongo_uri' tests pytest_mongo

Repository: dbfixtures/pytest-mongo

Length of output: 11839


🌐 Web query:

PyMongo MongoClient URI keyword arguments tls override URI options documentation

💡 Result:

In PyMongo, you can configure TLS/SSL options either by passing them as parameters within the connection URI or by passing them as keyword arguments (kwargs) to the MongoClient constructor [1][2][3]. When you provide the same option in both the connection URI and as a keyword argument, the keyword argument takes precedence [4][5]. For example, if you define the connection as follows: client = pymongo.MongoClient('mongodb://example.com/?tls=false', tls=True) The explicit keyword argument tls=True will override the tls=false option specified in the URI, and the client will connect using TLS [4][5]. This behavior applies to all connection options supported by the MongoClient, including TLS-specific settings such as tlsCAFile, tlsAllowInvalidCertificates, and tlsInsecure [6][2][3]. All such options can be passed directly to the MongoClient constructor to ensure they override any conflicting settings parsed from the connection string [4][5].

Citations:


Pass tls through for URI clients. NoopExecutor._make_client() ignores self.tls when self.uri is set, so mongo_uri + mongo_tls silently connects without TLS unless the URI already includes it. MongoClient(self.uri, tls=True) will override any conflicting URI option.

Proposed fix
         if self.uri:
-            return MongoClient(self.uri)
+            client_kwargs = {"tls": True} if self.tls else {}
+            return MongoClient(self.uri, **client_kwargs)
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
if self.uri:
return MongoClient(self.uri)
if self.uri:
client_kwargs = {"tls": True} if self.tls else {}
return MongoClient(self.uri, **client_kwargs)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@pytest_mongo/executor_noop.py` around lines 45 - 46,
NoopExecutor._make_client currently returns a MongoClient for self.uri without
passing through self.tls, so URI-based clients can ignore the TLS setting.
Update the self.uri branch in NoopExecutor._make_client to forward the tls flag
from self.tls when constructing MongoClient, ensuring mongo_uri and mongo_tls
stay in sync. Keep the change localized to NoopExecutor._make_client and
preserve the existing non-URI client path.

Comment on lines +47 to +48
if mongo_uri:
mongo_conn: MongoClient = MongoClient(mongo_uri, tz_aware=mongo_tz_aware)

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Verify URI+TLS client construction is covered.
rg -n 'mongo_uri|--mongo-uri|mongo_tls|--mongo-tls|tls=' pytest_mongo tests

Repository: dbfixtures/pytest-mongo

Length of output: 1451


🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Check whether the URI path is used with a TLS scheme or query options elsewhere.
rg -n 'tls|mongodb\+srv|ssl|retryWrites|authSource|uri' pytest_mongo tests README.md

Repository: dbfixtures/pytest-mongo

Length of output: 4255


Pass tls through on the URI client path.

MongoClient(mongo_uri, ...) drops mongo_tls, so --mongo-uri ... --mongo-tls falls back to a non-TLS connection unless TLS is already encoded in the URI. Thread the flag into this branch too.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@pytest_mongo/factories/client.py` around lines 47 - 48, The MongoDB client
creation path in client.py ignores the TLS flag when mongo_uri is provided, so
the URI-based branch in the MongoClient setup must pass through mongo_tls as
well. Update the mongo_uri branch in the client factory logic that creates
MongoClient so it threads the TLS option consistently with the non-URI path,
keeping the behavior aligned regardless of whether the connection comes from a
URI or individual settings.

Comment on lines +34 to +38
client[auth_source].command(
"createUser",
username,
pwd=password,
roles=[{"role": "root", "db": auth_source}],

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Check whether tests cover non-admin auth_source user creation.
rg -n 'auth_source|mongo_auth_source|authSource' tests pytest_mongo

Repository: dbfixtures/pytest-mongo

Length of output: 2762


Grant root from admin. auth_source is configurable, so non-admin setups will try to assign a built-in role on the wrong database.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@pytest_mongo/factories/process.py` around lines 34 - 38, The user creation in
the process factory is assigning the built-in root role against the configurable
auth_source database, which can be wrong for non-admin setups. Update the
createUser call in the process setup code to always grant the root role from
admin, while keeping auth_source only for the authentication database used by
the command. Use the createUser logic in process.py as the place to fix this and
ensure the role definition references admin explicitly.

Comment thread pytest_mongo/factories/process.py Outdated
mongo_executor.password = mongo_password or None
mongo_executor.auth_source = mongo_auth_source if mongo_username else None
mongo_executor.uri = None
mongo_executor.tls = False

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

Do not discard configured TLS for mongo_proc.

mongo_executor.tls is always False, so mongo_tls has no effect for process-backed clients, even when mongod TLS is configured through params.

Proposed fix
 def mongo_proc(
     executable: str | None = None,
     params: str | None = None,
     host: str | None = None,
     port: PortType | None = -1,
     username: str | None = None,
     password: str | None = None,
     auth_source: str | None = None,
+    tls: bool | None = None,
 ) -> Callable[[FixtureRequest, TempPathFactory], Iterator[MongoExecutor]]:
         mongo_auth_source = (
             auth_source if auth_source is not None else config.auth_source
         ) or "admin"
+        mongo_tls = tls if tls is not None else config.tls
 
         auth_flag = "--auth" if mongo_username else ""
             mongo_executor.auth_source = mongo_auth_source if mongo_username else None
             mongo_executor.uri = None
-            mongo_executor.tls = False
+            mongo_executor.tls = mongo_tls
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
mongo_executor.tls = False
def mongo_proc(
executable: str | None = None,
params: str | None = None,
host: str | None = None,
port: PortType | None = -1,
username: str | None = None,
password: str | None = None,
auth_source: str | None = None,
tls: bool | None = None,
) -> Callable[[FixtureRequest, TempPathFactory], Iterator[MongoExecutor]]:
@@
mongo_auth_source = (
auth_source if auth_source is not None else config.auth_source
) or "admin"
mongo_tls = tls if tls is not None else config.tls
auth_flag = "--auth" if mongo_username else ""
@@
mongo_executor.auth_source = mongo_auth_source if mongo_username else None
mongo_executor.uri = None
mongo_executor.tls = mongo_tls
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@pytest_mongo/factories/process.py` at line 156, The process-backed Mongo
setup is overwriting TLS on the executor, so configured TLS never takes effect.
Update the process client setup in the `mongo_executor` / `mongo_proc` path to
preserve the TLS setting from `params` instead of forcing `mongo_executor.tls`
to False, and make sure the factory logic in `process.py` passes the configured
TLS state through consistently.

Comment thread pytest_mongo/plugin.py
Comment on lines +119 to +130
parser.addoption(
"--mongo-tls",
action="store_true",
dest="mongo_tls",
help=_help_tls,
)
parser.addoption(
"--no-mongo-tls",
action="store_false",
dest="mongo_tls",
help=_help_tls,
)

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

Use an unset sentinel for paired TLS flags.

Both TLS flags should set default=None; otherwise omitted and explicit false are indistinguishable, and --no-mongo-tls cannot reliably override ini configuration.

Proposed fix
     parser.addoption(
         "--mongo-tls",
         action="store_true",
         dest="mongo_tls",
+        default=None,
         help=_help_tls,
     )
     parser.addoption(
         "--no-mongo-tls",
         action="store_false",
         dest="mongo_tls",
+        default=None,
         help=_help_tls,
     )

Apply the same sentinel pattern to any paired boolean flag that uses the shared config fallback.

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
parser.addoption(
"--mongo-tls",
action="store_true",
dest="mongo_tls",
help=_help_tls,
)
parser.addoption(
"--no-mongo-tls",
action="store_false",
dest="mongo_tls",
help=_help_tls,
)
parser.addoption(
"--mongo-tls",
action="store_true",
dest="mongo_tls",
default=None,
help=_help_tls,
)
parser.addoption(
"--no-mongo-tls",
action="store_false",
dest="mongo_tls",
default=None,
help=_help_tls,
)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@pytest_mongo/plugin.py` around lines 119 - 130, The paired TLS options in
plugin.py currently use a boolean default that makes omitted and explicit false
indistinguishable, which breaks the shared config fallback and prevents
--no-mongo-tls from reliably overriding ini settings. Update the argparse setup
in the option registration logic for mongo_tls so both addoption calls use an
unset sentinel default (default=None), and apply the same pattern to any other
paired boolean flags in this plugin that rely on config fallbacks.

Comment thread tests/test_auth.py
Comment on lines +42 to +43
@_needs_auth_service
@pytest.mark.xdist_group("noproc_auth")

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
fd -a '^(pyproject\.toml|pytest\.ini|tox\.ini|setup\.cfg)$' . | while read -r f; do
  echo "### $f"
  rg -n -C2 'xdist_group|markers|tool\.pytest\.ini_options' "$f" || true
done

Repository: dbfixtures/pytest-mongo

Length of output: 199


🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "### pyproject.toml"
cat -n pyproject.toml | sed -n '1,260p'

echo
echo "### tests/test_auth.py"
cat -n tests/test_auth.py | sed -n '1,220p'

echo
echo "### search for marker registration"
rg -n 'xdist_group|markers\s*=|addini|register_markers|pytest\.mark' . --glob '!*.pyc' --glob '!*.pytest_cache/*'

Repository: dbfixtures/pytest-mongo

Length of output: 10607


🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "### tests/test_mongo.py"
cat -n tests/test_mongo.py | sed -n '1,220p'

echo
echo "### search for pytest config section names"
rg -n '^\[tool\.pytest|^\[tool\.pytest\.ini_options\]|^\[pytest\]|markers\s*=' pyproject.toml pytest.ini tox.ini setup.cfg 2>/dev/null || true

echo
echo "### search for xdist_group registration or suppression"
rg -n 'xdist_group|filterwarnings|unknown mark|markers' . --glob '!*.pyc' --glob '!*.pytest_cache/*'

Repository: dbfixtures/pytest-mongo

Length of output: 2901


Register xdist_group as a pytest marker. Serial runs will keep emitting PytestUnknownMarkWarning until it is added to the pytest marker list; the same applies to the other xdist_group uses in the test suite.

🧰 Tools
🪛 GitHub Actions: Run tests / 2_mongo_8 _ tests (3.10).txt

[warning] 43-43: PytestUnknownMarkWarning: Unknown pytest.mark.xdist_group - is this a typo? Register custom marks to avoid this warning.

🪛 GitHub Actions: Run tests / 3_mongo_8 _ tests (3.14).txt

[warning] 43-43: PytestUnknownMarkWarning: Unknown pytest.mark.xdist_group - is this a typo? Register the custom mark to avoid this warning.

🪛 GitHub Actions: Run tests / 4_mongo_8 _ tests (3.11).txt

[warning] 43-43: PytestUnknownMarkWarning: Unknown pytest.mark.xdist_group - is this a typo? You can register custom marks to avoid this warning.

🪛 GitHub Actions: Run tests / 5_mongo_8 _ tests (3.13).txt

[warning] 43-43: PytestUnknownMarkWarning: Unknown pytest.mark.xdist_group - is this a typo? Register custom marks to avoid this warning.

🪛 GitHub Actions: Run tests / 6_mongo_8 _ tests (3.12).txt

[warning] 43-43: PytestUnknownMarkWarning: Unknown pytest.mark.xdist_group - is this a typo?

🪛 GitHub Actions: Run tests / 7_mongo_8 _ tests (3.15).txt

[warning] 43-43: PytestUnknownMarkWarning: Unknown pytest.mark.xdist_group - is this a typo? (test_auth.py:43, mark 'noproc_auth').

🪛 GitHub Actions: Run tests / 8_mongo_8 _ tests (pypy-3.11).txt

[warning] 43-43: PytestUnknownMarkWarning: Unknown pytest.mark.xdist_group - is this a typo? (register custom marks to avoid warning).

🪛 GitHub Actions: Run tests with auth-enabled MongoDB / 0_mongo_auth.txt

[warning] 43-43: PytestUnknownMarkWarning: Unknown pytest.mark.xdist_group - is this a typo? Register custom marks to avoid this warning.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@tests/test_auth.py` around lines 42 - 43, Register xdist_group as a
recognized pytest marker in the test configuration so serial runs stop emitting
PytestUnknownMarkWarning. Update the pytest marker list in the shared test setup
used by tests/test_auth.py and the other xdist_group usages, ensuring the marker
is declared consistently for the whole suite.

Source: Pipeline failures

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant