fix(pyats): disable EnvironmentDebugPlugin to prevent credential exposure

[oboehmer]

Description

Security fix: PyATS EnvironmentDebugPlugin was writing environment variables (including passwords) to env.txt files within archive artifacts. This change disables the plugin and refactors config file management for cleaner architecture.

Closes

• Fixes Security: Disable pyATS EnvironmentDebugPlugin to prevent credential exposure in env.txt #689
• Fixes Tech Debt: Consolidate PyATS config file creation in SubprocessRunner #570

Related Issue(s)

• N/A

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Refactoring / Technical debt (internal improvements with no user-facing changes)
• Documentation update
• Chore (build process, CI, tooling, dependencies)
• Other (please describe):

Test Framework Affected

• PyATS
• Robot Framework
• Both
• N/A (not test-framework specific)

Network as Code (NaC) Architecture Affected

• ACI (APIC)
• NDO (Nexus Dashboard Orchestrator)
• NDFC / VXLAN-EVPN (Nexus Dashboard Fabric Controller)
• Catalyst SD-WAN (SDWAN Manager / vManage)
• Catalyst Center (DNA Center)
• ISE (Identity Services Engine)
• FMC (Firepower Management Center)
• Meraki (Cloud-managed)
• NX-OS (Nexus Direct-to-Device)
• IOS-XE (Direct-to-Device)
• IOS-XR (Direct-to-Device)
• Hyperfabric
• All architectures
• N/A (architecture-agnostic)

Platform Tested

• macOS (version tested: macOS with Python 3.12)
• Linux (distro/version tested: )

Key Changes

Security (#689)

• Add EnvironmentDebugPlugin: enabled: False to plugin configuration
• Add E2E regression test scanning ALL output artifacts for credential sentinels
• Test covers both zip contents and all non-zip files

Architecture Refactoring (#570)

• Move config file creation from execute_job() into SubprocessRunner.__init__()
• Add cleanup() method to SubprocessRunner for config file removal
• Orchestrator calls cleanup() conditionally based on keep_artifacts policy
• Config file attributes only set after successful file creation (safer error handling)
• Extract config filenames as constants in constants.py
• Write config files to output_dir with well-known names instead of temp files

Dead Code Removal

• Remove unused _build_reporter_config() and _generate_plugin_config() from orchestrator
• Remove unnecessary tempfile.TemporaryDirectory wrapper in _run_tests_async
• Remove unused plugin_config_path parameter

Testing Done

• Unit tests added/updated (25 subprocess_runner unit tests)
• Integration tests performed (16 subprocess_runner integration tests)
• Manual testing performed:
  • PyATS tests executed successfully
  • Robot Framework tests executed successfully
  • D2D/SSH tests executed successfully (if applicable)
  • HTML reports generated correctly
• All existing tests pass (pytest / pre-commit run -a)

Test Commands Used

# Unit tests (25 subprocess_runner tests, 217 pyats_core tests total)
pytest tests/unit/pyats_core/execution/test_subprocess_runner.py -v
pytest tests/unit/pyats_core/ tests/pyats_core/ -v

# E2E credential exposure tests
pytest tests/e2e/test_e2e_scenarios.py -v -k "credential" -n auto --dist loadscope

# Pre-commit hooks
pre-commit run --all-files

Checklist

• Code follows project style guidelines (pre-commit run -a passes)
• Self-review of code completed
• Code is commented where necessary (especially complex logic)
• Documentation updated (if applicable)
• No new warnings introduced
• Changes work on both macOS and Linux
• CHANGELOG.md updated (if applicable)

Screenshots (if applicable)

N/A

Additional Notes

Design decisions:

• SubprocessRunner now owns both creation AND cleanup of its config files (cleaner SRP)
• Orchestrator retains policy control (decides when to call cleanup based on debug flags)
• Config file attributes (_plugin_config_file, _pyats_config_file) are Path | None and only set after successful creation — this ensures cleanup() is safe even if initialization partially failed