pytest.ini

[pytest]
testpaths = tests
addopts = -v --tb=short
markers =
    prerequisites: pre-flight system requirement checks (no containers needed)
    containers: container running/healthy/restart-loop checks
    connectivity: TCP port and HTTP redirect checks
    tls: TLS version and certificate expiry checks (warn-only for self-signed)
    services: service API health endpoint checks
    auth: authentication and login flow checks
    vpn: requires Gluetun to be running and healthy
    killswitch: modifies container state (stops/starts gluetun)
    observability: Prometheus targets, podman_exporter metrics, Grafana datasource/dashboard checks
    recyclarr: recyclarr sync integration test
    rotation: credential rotation tests — modifies live service state, restores after each test
    rotation_isolated: subset of rotation/pw_rotation safe to run in parallel with itself, provided same-app cases share an xdist worker (conftest.py groups them by app and the Makefile runs this tier with --dist loadgroup; without that the api-key case restarts a container the password case is mid-rotation on). The password-rotation cases only ever touch their own container and their own Prowlarr Application row. The api-key cases also touch homepage (rotate-api-keys.sh restarts it unconditionally on every invocation); that restart is retried against podman's transient "container state improper" error precisely because parallel invocations race on it, see conftest.py's restart_container() and rotate-api-keys.sh's own final step
    pw_rotation: credential rotation tests scoped to rotate-passwords.sh specifically — slow, restarts most of the stack
    scripts: smoke tests for the maintenance scripts in scripts/ (no live state mutation)
    wiring: app-to-app connection wiring tests — creates persistent DownloadClients/Applications entries, does not restore after each test
    wiring_readonly: subset of wiring that only reads the wiring back, so it needs no script re-run and writes nothing. Currently the Jellyfin connection cases: they GET the connection and POST the app's own /notification/test, which reports reachability without persisting anything. This tier is the one CI runs, after its own `make wire_connections` step; the module's autouse fixture skips the script entirely when the whole selection carries this marker
    security: hardening checks (no-new-privileges, cap_drop, non-root PUID/PGID, /config read/write)
    rinse_and_repeat: lifecycle stability — stop/start and down/start cycles (modifies container state)