feat: fix tests

Author: user-cube

cli/cmd/bootstrap_integration_test.go

@@ -129,7 +129,7 @@ func TestBootstrapIntegration_GitCryptKey(t *testing.T) {
 	secret := mockClient.GetSecret("argocd", "git-crypt-key")
 	assert.NotNil(t, secret)
 	assert.Equal(t, "git-crypt-key", secret.Name)
-	assert.Equal(t, keyData, secret.Data["key"])
+	assert.Equal(t, keyData, secret.Data["git-crypt-key"])
 }
 
 // TestBootstrapIntegration_SequentialErrors tests recovery by retrying after errors.

cli/cmd/template.go

@@ -273,6 +273,11 @@ func applyReplacement(workspaceRoot string, r replacement, dryRun bool) (int, er
 		// Replace
 		newContent := strings.ReplaceAll(originalContent, r.pattern, r.replace)
 
+		// Skip if content unchanged (idempotence)
+		if newContent == originalContent {
+			continue
+		}
+
 		if dryRun {
 			fmt.Printf("  [DRY RUN] Would update: %s\n", relPath)
 			changedCount++

cli/cmd/template_test.go

@@ -6,6 +6,7 @@ import (
 	"path/filepath"
 	"strings"
 	"testing"
+	"time"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -298,6 +299,66 @@ func TestApplyReplacement_NonExistentFile(t *testing.T) {
 	assert.Equal(t, 0, count) // Should skip non-existent files gracefully
 }
 
+func TestApplyReplacement_Idempotence(t *testing.T) {
+	// Test that applying the same replacement twice doesn't change the file
+	tmpDir := t.TempDir()
+
+	// Create test file with old pattern
+	testFile := filepath.Join(tmpDir, "test.yaml")
+	originalContent := `repoUrl: git@github.com:old-org/old-repo.git
+otherField: value
+`
+	err := os.WriteFile(testFile, []byte(originalContent), 0644)
+	require.NoError(t, err)
+
+	r := replacement{
+		name:    "Repository URLs",
+		pattern: "git@github.com:old-org/old-repo.git",
+		replace: "git@github.com:myorg/myrepo.git",
+		files:   []string{"test.yaml"},
+	}
+
+	// First run: pattern matches, replacement made
+	count, err := applyReplacement(tmpDir, r, false)
+	require.NoError(t, err)
+	assert.Equal(t, 1, count, "First run should update the file")
+
+	// Verify content changed
+	content, err := os.ReadFile(testFile)
+	require.NoError(t, err)
+	assert.Contains(t, string(content), "myorg/myrepo")
+	assert.NotContains(t, string(content), "old-org/old-repo")
+
+	// Get file info after first change
+	info1, err := os.Stat(testFile)
+	require.NoError(t, err)
+
+	// Sleep to ensure we can detect modification time changes
+	time.Sleep(10 * time.Millisecond)
+
+	// Second run with same replacement: should detect no change needed
+	r2 := replacement{
+		name:    "Repository URLs",
+		pattern: "git@github.com:myorg/myrepo.git",
+		replace: "git@github.com:myorg/myrepo.git", // Same as pattern - no-op
+		files:   []string{"test.yaml"},
+	}
+
+	count, err = applyReplacement(tmpDir, r2, false)
+	require.NoError(t, err)
+	assert.Equal(t, 0, count, "Second run should not update when content unchanged")
+
+	// Verify content unchanged
+	newContent, err := os.ReadFile(testFile)
+	require.NoError(t, err)
+	assert.Equal(t, string(content), string(newContent), "Content should remain unchanged")
+
+	// Verify file modification time didn't change
+	info2, err := os.Stat(testFile)
+	require.NoError(t, err)
+	assert.Equal(t, info1.ModTime(), info2.ModTime(), "File should not be modified when content unchanged")
+}
+
 func TestListGoFiles(t *testing.T) {
 	// Create temporary workspace with Go files
 	tmpDir := t.TempDir()

cli/cmd/validate.go

@@ -273,7 +273,7 @@ func validateRepoAccess(secrets *config.EnvironmentSecrets) validateResult {
 	ctx, cancel := contextWithTimeout(validateRepoTimeout)
 	defer cancel()
 
-	cmd := exec.CommandContext(ctx, path, "ls-remote", "--exit-code", secrets.Repo.URL, ref) // #nosec G204
+	cmd := exec.CommandContext(ctx, path, "ls-remote", "--exit-code", "--", secrets.Repo.URL, ref) // #nosec G204
 	output, err := cmd.CombinedOutput()
 	if err != nil {
 		return validateResult{name: "repo access", err: fmt.Errorf("git ls-remote failed: %w\n  output: %s", err, string(output))}
@@ -325,7 +325,7 @@ func validateSSHRepoAccess(secrets *config.EnvironmentSecrets) validateResult {
 	ctx, cancel := contextWithTimeout(validateRepoTimeout)
 	defer cancel()
 
-	cmd := exec.CommandContext(ctx, path, "ls-remote", "--exit-code", repoURL, ref) // #nosec G204
+	cmd := exec.CommandContext(ctx, path, "ls-remote", "--exit-code", "--", repoURL, ref) // #nosec G204
 	cmd.Env = append(os.Environ(), fmt.Sprintf("GIT_SSH_COMMAND=ssh -i %q -o BatchMode=yes -o StrictHostKeyChecking=yes", keyFile.Name()))
 	output, err := cmd.CombinedOutput()
 	if err != nil {

cli/internal/k8s/client_mock.go

@@ -109,7 +109,7 @@ func (m *MockClient) CreateGitCryptKeySecret(ctx context.Context, keyData []byte
 		},
 		Type: corev1.SecretTypeOpaque,
 		Data: map[string][]byte{
-			"key": keyData,
+			"git-crypt-key": keyData,
 		},
 	}