Fix three flaky integration tests (#4803)

## Summary

Three previously-failing integration tests, plus a CI fix for a
coverage-config issue that was masking the runner's exit status.

### Test fixes

-
**`test_build_notebook_dependency_graphs_installs_pytest_from_index_url`**
(and its installed-twice sibling) — generate the notebook fixture at
test time using whichever pip mirror is configured locally. The helper
shells out to `python -m pip config list` (not `pip config get`, because
`get` only inspects `user`/`global`/`site` scopes and ignores the `env`
scope that `PIP_CONFIG_FILE` loads as) and parses the
`global.index-url='...'` line. Falls back to public PyPI when no mirror
is configured. The same test now exercises the JFrog mirror in CI and
the dev proxy locally without any environment knowledge baked into the
test code. Depends on #4804 keeping the JFrog URL credential-free.
- **`test_installation_when_dashboard_id_is_invalid`** — skipped; it
exercises a deprecated dashboard API, matching the existing skip on line
185 of the same file.
- **`test_create_account_level_groups_nested_groups`** — scoped the
final assertion to the 4 groups the test actually creates, instead of
asserting a global "no mismatches anywhere" log line that gets polluted
by stale UCX groups left in the shared workspace by earlier runs.

### CI: pin `COVERAGE_RCFILE`

The integration job was failing with `failed: trigger: run: unknown:
exit status 3` even when zero tests failed. Root cause: the
`databrickslabs/sandbox/acceptance` wrapper invokes pytest in multiple
per-directory sessions, and coverage.py walks up from CWD looking for
config. At least one CWD wasn't surfacing the project's
`pyproject.toml`, so coverage fell back to defaults (`branch=false`) and
wrote line data while sibling sessions wrote arc data. The final
session's `cov.combine()` then raised `Can't combine arc data with line
data`. Setting `COVERAGE_RCFILE: ${{ github.workspace }}/pyproject.toml`
forces every session to read the same `[tool.coverage.run]` config
regardless of CWD.

## Test plan

- [x] `make fmt` (black, ruff, mypy, pylint 10.00/10)
- [x] `make test` (2011 passed, coverage 89.83%)
- [x] `labs test-one` for each of the three originally-failing
integration tests
- [x] CI integration job green (76 ✅ / 0 ❌ / 11 ⏭️, all 11 pytest
sessions exit 0)

---------

Co-authored-by: Andrew Snare <andrew.snare@databricks.com>

Author: FastLee

.build-constraints.txt

@@ -1,13 +1,13 @@
 hatchling==1.29.0 \
     --hash=sha256:50af9343281f34785fab12da82e445ed987a6efb34fd8c2fc0f6e6630dbcc1b0 \
     --hash=sha256:793c31816d952cee405b83488ce001c719f325d9cda69f1fc4cd750527640ea6
-packaging==26.0 \
-    --hash=sha256:00243ae351a257117b6a241061796684b084ed1c516a08c48a3f7e147a9d80b4 \
-    --hash=sha256:b36f1fef9334a5588b4166f8bcd26a14e521f2b55e6b9de3aaa80d3ff7a37529
+packaging==26.1 \
+    --hash=sha256:5d9c0669c6285e491e0ced2eee587eaf67b670d94a19e94e3984a481aba6802f \
+    --hash=sha256:f042152b681c4bfac5cae2742a55e103d27ab2ec0f3d88037136b6bfe7c9c5de
     # via hatchling
-pathspec==1.0.4 \
-    --hash=sha256:0210e2ae8a21a9137c0d470578cb0e595af87edaa6ebf12ff176f14a02e0e645 \
-    --hash=sha256:fb6ae2fd4e7c921a165808a552060e722767cfa526f99ca5156ed2ce45a5c723
+pathspec==1.1.0 \
+    --hash=sha256:574b128f7456bd899045ccd142dd446af7e6cfd0072d63ad73fbc55fbb4aaa42 \
+    --hash=sha256:f5d7c555da02fd8dde3e4a2354b6aba817a89112fa8f333f7917a2a4834dd080
     # via hatchling
 pluggy==1.6.0 \
     --hash=sha256:7dcc130b76258d33b90f61b658791dede3486c3e6bfb003ee5c9bfb396dd22f3 \

.github/workflows/acceptance.yml

@@ -58,3 +58,7 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           ARM_CLIENT_ID: ${{ secrets.ARM_CLIENT_ID }}
           ARM_TENANT_ID: ${{ secrets.ARM_TENANT_ID }}
+          # Pin coverage.py to the project's [tool.coverage.run] config (branch = true,
+          # parallel = true) regardless of which CWD the acceptance wrapper invokes pytest
+          # from, so every session writes the same data shape and combine() succeeds.
+          COVERAGE_RCFILE: ${{ github.workspace }}/pyproject.toml

pyproject.toml

@@ -101,7 +101,7 @@ pytest = [
 ]
 test = [
     { include-group = "pytest" },
-    "pip",
+    "pip~=26.0",
     "python-lsp-server>=1.9.0",
 ]
 

tests/integration/account/test_account.py

@@ -74,7 +74,7 @@ def test_create_account_level_groups(
 
 
 def test_create_account_level_groups_nested_groups(
-    make_group, make_user, acc, ws, make_random, clean_account_level_groups, watchdog_purge_suffix, runtime_ctx, caplog
+    make_group, make_user, acc, ws, make_random, clean_account_level_groups, watchdog_purge_suffix, runtime_ctx
 ):
     suffix = f"{make_random(4).lower()}-{watchdog_purge_suffix}"
     # Test groups:
@@ -109,6 +109,7 @@ def test_create_account_level_groups_nested_groups(
         assert group
         assert len(group.members) == len(ws_group.members)
 
-    runtime_ctx.group_manager.validate_group_membership()
-
-    assert 'There are no groups with different membership between account and workspace.' in caplog.text
+    mismatches = runtime_ctx.group_manager.validate_group_membership()
+    created_names = {g.display_name for g in ws_groups}
+    mismatched_created = {m["wf_group_name"] for m in mismatches} & created_names
+    assert not mismatched_created, f"Created groups have mismatched membership: {mismatched_created}"

tests/integration/conftest.py

@@ -1,8 +1,8 @@
-import json
-import functools
 import collections
-import os
+import functools
+import json
 import logging
+import os
 import shutil
 import subprocess
 from collections.abc import Callable, Generator

tests/integration/install/test_installation.py

@@ -214,6 +214,7 @@ def test_installation_when_dashboard_is_trashed(ws, installation_ctx):
     assert True, "Installation succeeded when dashboard was trashed"
 
 
+@pytest.mark.skip(reason="Legacy dashboard creation is no longer supported by Databricks.")
 @pytest.mark.parametrize("dashboard_id", ["01ef4d7b294112968fa07ffae17dd55f", "invalid-dashboard-id", ""])
 def test_installation_when_dashboard_id_is_invalid(ws, installation_ctx, dashboard_id):
     """A dashboard reference might be invalid (after manual changes), the upgrade should handle this."""

tests/integration/source_code/test_libraries.py

@@ -5,6 +5,9 @@
 
 import logging
 import re
+import subprocess
+import sys
+import textwrap
 from pathlib import Path
 
 import pytest
@@ -13,6 +16,42 @@
 from tests.unit.conftest import MockPathLookup
 
 
+def _resolved_index_url() -> str:
+    """Return whichever pip mirror is configured locally, or public PyPI as a fallback.
+
+    Note: this only checks the configuration files, it ignores the PIP_INDEX_URL environment variable.
+    """
+    # Cannot use 'config get': that will not consult the file if PIP_CONFIG_FILE is set.
+    cmd = [sys.executable, "-m", "pip", "config", "list"]
+    result = subprocess.run(cmd, capture_output=True, text=True, check=False, timeout=10)
+    if result.returncode == 0:
+        for line in result.stdout.splitlines():
+            if line.startswith("global.index-url="):
+                return line.split("=", 1)[1].strip().strip("'\"")
+    return "https://pypi.python.org/simple"
+
+
+def _write_pytest_with_index_url_notebook(directory: Path) -> str:
+    notebook_name = "pip_install_pytest_with_index_url"
+    notebook = directory / f"{notebook_name}.py"
+    notebook.write_text(
+        textwrap.dedent(
+            f"""\
+            # Databricks notebook source
+
+            # COMMAND ----------
+
+            # MAGIC %pip install pytest --index-url {_resolved_index_url()}
+
+            # COMMAND ----------
+
+            import pytest
+            """
+        )
+    )
+    return notebook_name
+
+
 @pytest.mark.parametrize(
     "notebook",
     (
@@ -31,11 +70,10 @@ def test_build_notebook_dependency_graphs_installs_wheel_with_pip_cell_in_notebo
     assert maybe.graph.all_relative_names() == {f"{notebook}.py", "thingy/__init__.py"}
 
 
-def test_build_notebook_dependency_graphs_installs_pytest_from_index_url(simple_ctx):
-    ctx = simple_ctx.replace(path_lookup=MockPathLookup())
-    maybe = ctx.dependency_resolver.build_notebook_dependency_graph(
-        Path("pip_install_pytest_with_index_url"), CurrentSessionState()
-    )
+def test_build_notebook_dependency_graphs_installs_pytest_from_index_url(simple_ctx, tmp_path):
+    notebook_name = _write_pytest_with_index_url_notebook(tmp_path)
+    ctx = simple_ctx.replace(path_lookup=MockPathLookup(cwd=tmp_path))
+    maybe = ctx.dependency_resolver.build_notebook_dependency_graph(Path(notebook_name), CurrentSessionState())
     assert not maybe.problems
 
 
@@ -79,11 +117,18 @@ def test_build_notebook_dependency_graphs_when_installing_pytest_twice(caplog, s
     (
         "pip_install_demo_wheel",
         "pip_install_multiple_packages",
-        "pip_install_pytest_with_index_url",
     ),
 )
 def test_build_notebook_dependency_graphs_when_installing_notebooks_twice(caplog, simple_ctx, notebook) -> None:
     ctx = simple_ctx.replace(path_lookup=MockPathLookup())
     for _ in range(2):
         maybe = ctx.dependency_resolver.build_notebook_dependency_graph(Path(notebook), CurrentSessionState())
         assert not maybe.problems
+
+
+def test_build_notebook_dependency_graphs_when_installing_pytest_from_index_url_twice(simple_ctx, tmp_path) -> None:
+    notebook_name = _write_pytest_with_index_url_notebook(tmp_path)
+    ctx = simple_ctx.replace(path_lookup=MockPathLookup(cwd=tmp_path))
+    for _ in range(2):
+        maybe = ctx.dependency_resolver.build_notebook_dependency_graph(Path(notebook_name), CurrentSessionState())
+        assert not maybe.problems