test: add reusable hostile-input harness

[estivate]

Summary

Several configuration tests created their own versions of unusual or unsafe input data. This made the tests repetitive and harder to maintain.

This PR adds one shared test helper and updates the existing configuration tests to use it. The tests confirm that invalid input is rejected safely, does not run code hidden in the input, and does not expose input values in error messages.

No application code changes.

Before and after

Before:

@pytest.mark.parametrize("root_kind", ["none", "list", "dict-subclass", ...])
def test_safe_parse_rejects_non_dict_roots_without_callbacks(root_kind: str):
    ...

After:

@pytest.mark.parametrize(
    "case",
    [pytest.param(case, id=case.id) for case in _configuration_root_cases()],
)
def test_safe_parse_enforces_exact_dict_roots_without_callbacks(case: BoundaryCase):
    ...

Validation

• uv sync: passed
• uv run invoke format: passed
• uv run invoke lint: passed; four inherited ty warnings outside this diff
• Focused harness and configuration tests: 525 passed in 2.14s
• Unit selection with coverage: 2,142 passed, 3 skipped, 20 deselected, 1 xfailed in 125.58s
• Overall line coverage: 84.953% → 84.976%; branch coverage unchanged at 76.480%
• Coverage-run time: 136.90s on the merged base → 125.58s on this branch
• Slowest test: 6.30s on the merged base → 5.94s on this branch; both runs were led by existing deployment tests outside this change
• Exact-head sync-reviewer preflight: passed after restoring existing Unicode assertions, binding every callback to its case tripwire, and pinning every attack payload
• Four required mutation spot-checks and the forged-callback mutation failed as expected and were restored
• git diff --check: passed
• CLI help and list: passed
• CLI generate reached the configured server but stopped at the documented external precondition because its schema lacks the example models

User-visible changes

None. This PR changes tests only.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: ae3544a0-4abe-4f98-af8c-4d604d63bea3

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[cloudflare-workers-and-pages]

Deploying infrahub-sync with    Cloudflare Pages

Latest commit:	93a82b9
Status:	✅  Deploy successful!
Preview URL:	https://fc577df6.infrahub-sync.pages.dev
Branch Preview URL:	https://test-hostile-input-harness-v.infrahub-sync.pages.dev

View logs