test(live): port func-tests/ from pytest to a cargo integration test (#1606)

The Python `func-tests/test_live_smoke.py` was the last
non-vendored Python in the repo — a pytest harness driving the
real `mergify` binary against the canary repo's Mergify API
endpoints. Now that every command is native, the test runner
itself is the only thing keeping `setup-python` in CI.

Port the 10 tests + the conftest fixtures to a cargo integration
test at `crates/mergify-cli/tests/live_smoke.rs`. 1:1 with the
Python version on contract — same scrubbed env list, same
assertion messages, same skip-on-missing-token behaviour. The
JUnit fixture moves to `crates/mergify-cli/tests/fixtures/` so
cargo packages it consistently.

Notable bits:

  - `env!("CARGO_BIN_EXE_mergify")` for the binary path — cargo
    sets it at compile time so the test can't accidentally pick
    up an installed binary on `$PATH`.
  - Token-gated tests early-return after `eprintln!("SKIP: ...")`.
    Cargo's stock harness has no "skip" outcome; surfacing the
    skip in stderr (visible under `cargo test -- --nocapture`)
    means a missing-secret regression in CI can't slip past as a
    silent green.
  - Cleanup runs from `Drop` (queue unpause; freeze delete) so a
    mid-test assertion failure still leaves the canary repo in
    the state we found it. Warn (don't panic) inside `drop` so a
    cleanup-time issue can't mask the real test failure.
  - `wait_timeout` polls `Child::try_wait` to mirror Python
    `subprocess.run(timeout=30)`; pulls in no new crate. Kills
    and panics on timeout so a hung binary fails fast instead of
    riding cargo's longer wall-clock.

CI workflow trimmed: drops `setup-python`, drops the `pip install
pytest` step, drops `PATH` plumbing for the built binary. Test
runner is `cargo test --release --test live_smoke -- --nocapture`.
The release build path is the one whose binary the contract is
pinned against — debug builds would skip the `strip` step that
`build-wheels.yml` enables in production.

Local verification (Linux/macOS, no tokens set): the 3 hermetic
tests pass, the 8 token-gated tests each log
`SKIP: live_(admin_)token() (env var unset)` and early-return.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: jd

.github/workflows/func-tests-live.yaml

@@ -3,7 +3,7 @@ name: Live functional tests
 # Hits the real Mergify API against
 # mergify-clients-testing/mergify-cli-repo PR #1. Runs on every PR.
 # NOT wired into the PR `ci-gate` job — an upstream blip must not
-# block PRs. See `func-tests/test_live_smoke.py`.
+# block PRs. See `crates/mergify-cli/tests/live_smoke.rs`.
 
 permissions: read-all
 
@@ -17,42 +17,32 @@ jobs:
     environment: func-tests-live
     steps:
       - uses: actions/checkout@v6.0.3
-      - uses: actions/setup-python@v6.2.0
-        with:
-          python-version: 3.14
 
       - name: Install Rust toolchain
         run: |
           rustup toolchain install stable --profile minimal
           rustup default stable
       - uses: Swatinem/rust-cache@v2
 
-      - name: Build mergify binary
-        run: cargo build --release
-
-      - name: Put built binary on PATH
-        run: echo "${PWD}/target/release" >> "${GITHUB_PATH}"
-
       - name: Live smoke tests
-        shell: bash
         env:
           # Two tokens with different scopes:
           # - _CI exercises CI-tooling endpoints (scopes-send,
           #   junit-process). ci git-refs / queue-info are
           #   locally evaluated and need no token at all.
           # - _ADMIN exercises every endpoint under /merge-queue/
-          #   (status, show, pause, unpause). The CI token is
-          #   rejected with 403 on these, so they all share the
-          #   queue-management-scoped admin token.
-          # Tests select the appropriate fixture; absent tokens
-          # cause individual tests to skip rather than fail.
+          #   (status, show, pause, unpause) and the
+          #   /scheduled_freeze endpoints (list, create, update,
+          #   delete). The CI token is rejected with 403 on these,
+          #   so they all share the queue-management-scoped admin
+          #   token.
+          # Tests early-return with `SKIP:` when their token is
+          # unset rather than failing — local runs without secrets
+          # still produce a useful subset.
           LIVE_TEST_MERGIFY_TOKEN_CI: ${{ secrets.MERGIFY_CLI_LIVE_TEST_MERGIFY_TOKEN_CI }}
           LIVE_TEST_MERGIFY_TOKEN_ADMIN: ${{ secrets.MERGIFY_CLI_LIVE_TEST_MERGIFY_TOKEN_ADMIN }}
-        # Use `pip install pytest` over an ephemeral `uv tool run`
-        # so the func-tests don't drag any package-management
-        # tool into the supported-runtime contract. The wheel
-        # itself has no Python deps; pytest only matters here as
-        # the test runner.
-        run: |
-          pip install --user 'pytest>=8'
-          python -m pytest -v func-tests/ -m live
+        # `--nocapture` so the `SKIP:` lines stay visible — without
+        # it, cargo eats stderr on passing tests and a silently-
+        # skipped run on a missing-secret regression would look
+        # green.
+        run: cargo test --release --test live_smoke -- --nocapture