[khushalsonawat]

Description

tests/test_harness_secrets.py::test_worker_never_inherits_host_voice_provider_credentials (now test_worker_inherits_only_the_runners_cartesia_voice_credential) has failed since August. It says the sandbox worker never inherits the runner's CARTESIA_API_KEY. Two days after it was written, f0b3fce (#69, "pass the caller voice and Vertex region through to the worker") put that key in the worker allow-list on purpose: the runner's Cartesia key voices the simulated caller (call_runner.py, cartesia_key). The same commit made it a name a job can't replace. The allow-list is right and the test is stale. It isn't in CI's sdk-smoke.yml list, so nothing caught it.

Type of Change

• Test update
• CI

Changes

• sdk-smoke.yml now runs tests/test_harness_secrets.py, so a failure there can't go unseen again.
• The test now holds the current rule: the worker inherits the runner's Cartesia key, a job's own CARTESIA_API_KEY doesn't replace it, and the runner's LiveKit and Deepgram credentials still stay out, including when a job sends no LiveKit key of its own. The test is renamed to say what it checks.

Testing

• tests/test_harness_secrets.py: 17 passed, the whole file (Python 3.12.3, hermetic). No other test in it fails on this branch.
• Review: one reviewer on the whole PR, clear (2 Lows, both fixed in e5fd3e1), and a one-reviewer check of that fix, clear. Results are in the comments.

Related Issues

Refs: TH-9550 (found while moving #307 onto this branch)

[khushalsonawat]

Review result for this PR (one reviewer, tests and CI):

• The whole PR (9afb686, 9b1e42a): clear, with 0 High, 0 Medium and 2 Low.
  • The test now matches the code. The whole file passes: 17 passed. On the base it fails only the old Cartesia assertion.
  • Three wrong builds each fail the test: the worker inheriting the runner's LiveKit secret, inheriting its Deepgram key, or letting a job replace the Cartesia key.
  • The two Lows: the test's name said the opposite of what it checks, and nothing caught the worker inheriting the runner's LIVEKIT_API_KEY when a job sends none.
• The fix for both Lows (e5fd3e1): clear on its own one-reviewer check, 0 findings above Low.
  • The test is renamed, and it has a new no-LiveKit-key case.
  • Two wrong builds each fail the new case.
  • Nothing else used the old name, and CI's list names the file, not the test.

[khushalsonawat]

CI after merging the base (8b2a7d8): SDK smoke's clean-install failed on one test, and that failure comes from the base, not from this PR.

• This PR's run: test_contract_model.py::test_a_crafted_file_of_block_comments_does_not_hold_up_the_check[a-file-of-openers] took 0.502 s against a 0.5 s bound. Everything else passed: 5974 passed. run
• The base's own run: the base, feat/TH-8804-source-subfolder at 084bca2, fails the same case on its push run (0.507 s against 0.5 s). run
• This PR doesn't touch that file or the code it times. [TH-9042] fix(harness): keep customers' credential files from the model on every reader #294 halves that case's input. The failed jobs are re-running.