Files
kevinveenbirkenbachandClaude Opus 5.5 6e776a5780 refactor(python): clear the open CodeQL code-quality alerts
- Declare `__all__` in every package `__init__.py` whose `PROJECT_ROOT`
  is imported by its modules (163 packages), so the constant counts as
  exported; list every public name where the package defines more.
- Empty the 15 package `__init__.py` files whose `PROJECT_ROOT` no module
  imports.
- Declare the public API of `utils.github.variant.axes` in `__all__`,
  re-exports included, instead of silencing them with `noqa: F401`; the
  list matches the one `feature/store-i18n` already carries.
- Use `import unittest.mock as mock` in `test_applications.py`, as the
  rest of the suite does.
- Spell `_NON_PRINTABLE` in `utils/yaml_bootstrap.py` as the equivalent
  BMP-only positive class; it matches exactly the same 2111 code points
  as the old negated class across U+0000..U+10FFFF.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
2026-10-20 21:40:58 +02:00
..

lookup('config', …) Path Validation 🔎

Integration tests that statically validate every lookup('config', application_id, …) (and quoted-app variants) found in role YAML and Jinja templates against the role's effective configuration.

Tests in this directory MUST only cover the four classifications of a single project-wide match stream: literal-app calls (test_literal_paths.py), variable-app calls with an existing literal path (test_variable_paths.py), ~-concatenated path expressions (test_wildcard_paths.py), and the strict per-role pass for lookup('config', application_id, …) calls inside roles/<role>/... (test_role_local_paths.py). Pure unit coverage of the lookup plugin's return values MUST live under tests/unit/python/plugins/lookup/.

The match stream is built once per process by _scan.iter_matches and shared across the four test classes; the repo-derived context (application defaults, user defaults, per-role schemas, application_id-declaring role set) comes from _scan.get_context. Validation helpers live in _validate.py. Suppression is wired through the project's noqa / nocheck grammar; the rule key is lookup-config-path (see suppression.md).

For framework, directory layout, and make test-integration usage see integration.md.