test(cli): clear service-specific AWS endpoint overrides in every test stub (#2227)

Shared clearAWSEndpointOverrides helper blanks AWS_ENDPOINT_URL_* and
AWS_IGNORE_CONFIGURED_ENDPOINT_URLS; used by isolateAWSEnv, rdsAPIStub.serveEnv
and the GCP signal child launcher.

Closes #2222

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

Author: cristim

cmd/configure_gcp_signal_test.go

@@ -146,6 +146,8 @@ func childState(child *exec.Cmd) string {
 
 func startGCPInterruptChild(t *testing.T, phase string) (*exec.Cmd, string, io.ReadCloser, *syncBuffer) {
 	t.Helper()
+	// The child inherits this env; it sets its own secretsmanager endpoint.
+	clearAWSEndpointOverrides(t)
 	dir := t.TempDir()
 	adc := filepath.Join(dir, "adc.json")
 	require.NoError(t, os.WriteFile(adc, []byte(`{"type":"authorized_user","client_id":"fixture","client_secret":"fixture","refresh_token":"fixture"}`), 0600))

cmd/multi_service_extended_support_unavailable_test.go

@@ -161,7 +161,7 @@ func (s *rdsAPIStub) serveEnv(t *testing.T) {
 	t.Setenv("AWS_SHARED_CREDENTIALS_FILE", empty)
 	t.Setenv("AWS_EC2_METADATA_DISABLED", "true")
 	t.Setenv("AWS_PROFILE", "")
-	t.Setenv("AWS_IGNORE_CONFIGURED_ENDPOINT_URLS", "")
+	clearAWSEndpointOverrides(t)
 	t.Setenv("AWS_ACCESS_KEY_ID", "AKIDEXAMPLE")
 	t.Setenv("AWS_SECRET_ACCESS_KEY", "secret")
 	t.Setenv("AWS_SESSION_TOKEN", "")

cmd/multi_service_test.go

@@ -1648,6 +1648,20 @@ func TestFilterAndAdjustRecommendations(t *testing.T) {
 	}
 }
 
+// clearAWSEndpointOverrides blanks every service-specific AWS_ENDPOINT_URL_*
+// variable and AWS_IGNORE_CONFIGURED_ENDPOINT_URLS for the test, so a
+// developer's global overrides can neither bypass nor disable a test's local
+// endpoint. Set the test's own endpoint variables after calling it.
+func clearAWSEndpointOverrides(t *testing.T) {
+	t.Helper()
+	for _, kv := range os.Environ() {
+		if name, _, _ := strings.Cut(kv, "="); strings.HasPrefix(name, "AWS_ENDPOINT_URL_") {
+			t.Setenv(name, "")
+		}
+	}
+	t.Setenv("AWS_IGNORE_CONFIGURED_ENDPOINT_URLS", "")
+}
+
 // isolateAWSEnv pins the AWS environment to deterministic invalid static
 // credentials and points every SDK client at a local server that answers 403
 // AccessDenied, so the runToolFromCSV tests behave identically on credentialed
@@ -1674,13 +1688,7 @@ func isolateAWSEnv(t *testing.T) *atomic.Int64 {
 	}))
 	t.Cleanup(srv.Close)
 
-	// A developer's global endpoint overrides must not bypass the local server.
-	for _, kv := range os.Environ() {
-		if name, _, _ := strings.Cut(kv, "="); strings.HasPrefix(name, "AWS_ENDPOINT_URL_") {
-			t.Setenv(name, "")
-		}
-	}
-	t.Setenv("AWS_IGNORE_CONFIGURED_ENDPOINT_URLS", "")
+	clearAWSEndpointOverrides(t)
 	t.Setenv("AWS_ENDPOINT_URL", srv.URL)
 	return hits
 }

cmd/purchase_confirmation_test.go

@@ -150,10 +150,10 @@ func TestRunToolFromCSVRequiresTerminal(t *testing.T) {
 	t.Setenv("HTTP_PROXY", server.URL)
 	t.Setenv("HTTPS_PROXY", server.URL)
 	t.Setenv("NO_PROXY", "")
+	clearAWSEndpointOverrides(t)
 	for _, key := range []string{"AWS_ENDPOINT_URL", "AWS_ENDPOINT_URL_RDS", "AWS_ENDPOINT_URL_EC2"} {
 		t.Setenv(key, server.URL)
 	}
-	t.Setenv("AWS_IGNORE_CONFIGURED_ENDPOINT_URLS", "false")
 	cfg := toolCfg
 	cfg.ActualPurchase = actualPurchase
 	cfg.Coverage = 100