Fix e2e test skip logic for undefined ADO pipeline variables

When a pipeline variable referenced in a step env: block is not defined,
ADO injects the literal string '' into the process environment
instead of an empty value. That literal is truthy, so plain os.getenv()
guards fail to skip and tests error trying to open '' as a path.

Fix: add _clean_env() helper in both lab_config.py and test_e2e.py that
returns None for unset values AND for ADO-literal '' strings.

- lab_config.py: _get_credential() and get_client_certificate() use _clean_env()
- test_e2e.py: get_lab_app() uses _clean_env(); PublicCloudScenariosTestCase
  setUpClass() guard uses _clean_env()

This makes all LabBasedTestCase and PublicCloudScenariosTestCase tests skip
cleanly (rather than error) when LAB_APP_CLIENT_ID is not configured as a
pipeline variable.

Author: RyAuld

tests/lab_config.py

@@ -164,6 +164,21 @@ class AppConfig:
 _msal_team_client: Optional[SecretClient] = None
 
 
+def _clean_env(name: str) -> Optional[str]:
+    """Return the env var value, or None if unset or it contains an unexpanded
+    ADO pipeline variable literal such as ``$(VAR_NAME)``.
+
+    Azure DevOps injects the literal string ``$(VAR_NAME)`` when a ``$(...)``
+    reference in a step ``env:`` block refers to a variable that has not been
+    defined at runtime.  That literal is truthy, so a plain ``os.getenv()``
+    check would incorrectly proceed as if the variable were set.
+    """
+    value = os.getenv(name)
+    if value and value.startswith("$("):
+        return None
+    return value or None
+
+
 def _get_credential():
     """
     Create an Azure credential for Key Vault access.
@@ -177,8 +192,8 @@ def _get_credential():
     Raises:
         EnvironmentError: If required environment variables are not set.
     """
-    client_id = os.getenv("LAB_APP_CLIENT_ID")
-    cert_path = os.getenv("LAB_APP_CLIENT_CERT_PFX_PATH")
+    client_id = _clean_env("LAB_APP_CLIENT_ID")
+    cert_path = _clean_env("LAB_APP_CLIENT_CERT_PFX_PATH")
     tenant_id = "72f988bf-86f1-41af-91ab-2d7cd011db47"  # Microsoft tenant
 
     if not client_id:
@@ -396,7 +411,7 @@ def get_client_certificate() -> Dict[str, object]:
     Raises:
         EnvironmentError: If LAB_APP_CLIENT_CERT_PFX_PATH is not set.
     """
-    cert_path = os.getenv("LAB_APP_CLIENT_CERT_PFX_PATH")
+    cert_path = _clean_env("LAB_APP_CLIENT_CERT_PFX_PATH")
     if not cert_path:
         raise EnvironmentError(
             "LAB_APP_CLIENT_CERT_PFX_PATH environment variable is required "

tests/test_e2e.py

@@ -54,6 +54,14 @@
     os.getenv("TRAVIS") or os.getenv("TF_BUILD") or not os.getenv("CI")
 )
 
+
+def _clean_env(name):
+    """Return the env var value, or None if unset or it contains an unexpanded
+    ADO pipeline variable literal such as ``$(VAR_NAME)``."""
+    value = os.getenv(name)
+    return None if (not value or value.startswith("$(")) else value
+
+
 def _get_app_and_auth_code(
         client_id,
         client_secret=None,
@@ -345,7 +353,7 @@ class PublicCloudScenariosTestCase(E2eTestCase):
 
     @classmethod
     def setUpClass(cls):
-        if not os.getenv("LAB_APP_CLIENT_ID"):
+        if not _clean_env("LAB_APP_CLIENT_ID"):
             raise unittest.SkipTest(
                 "LAB_APP_CLIENT_ID not set; skipping PublicCloud e2e tests")
         pca_app = get_app_config(AppSecrets.PCA_CLIENT)
@@ -473,13 +481,14 @@ def get_lab_app(
         "Reading ENV variables %s and %s for lab app defined at "
         "https://docs.msidlab.com/accounts/confidentialclient.html",
         env_client_id, env_client_cert_path)
-    if os.getenv(env_client_id) and os.getenv(env_client_cert_path):
+    client_id = _clean_env(env_client_id)
+    cert_path = _clean_env(env_client_cert_path)
+    if client_id and cert_path:
         # id came from https://docs.msidlab.com/accounts/confidentialclient.html
-        client_id = os.getenv(env_client_id)
         client_credential = {
             "private_key_pfx_path":
                 # Cert came from https://ms.portal.azure.com/#@microsoft.onmicrosoft.com/asset/Microsoft_Azure_KeyVault/Certificate/https://msidlabs.vault.azure.net/certificates/LabAuth
-                os.getenv(env_client_cert_path),
+                cert_path,
             "public_certificate": True,  # Opt in for SNI
             }
     else: