Isolate CLI tests from host configuration

cmd/audita/main_integration_test.go

@@ -571,6 +571,15 @@ func runCLISubprocessContext(t *testing.T, ctx context.Context, extraEnv map[str
 	cmdArgs := append([]string{"-test.run=TestHelperProcess", "--"}, args...)
 	cmd := exec.CommandContext(ctx, os.Args[0], cmdArgs...)
 	env := append(filterAuditaEnv(os.Environ()), "GO_WANT_HELPER_PROCESS=1")
+	// Use defaults without discovering the host's installed configuration.
+	// Explicit test environment overrides and --config retain their precedence.
+	if _, supplied := extraEnv["AUDITA_CONFIG"]; !supplied {
+		configPath := filepath.Join(t.TempDir(), "config.yml")
+		if err := os.WriteFile(configPath, []byte("version: 1\n"), 0600); err != nil {
+			t.Fatalf("write baseline config: %v", err)
+		}
+		env = append(env, "AUDITA_CONFIG="+configPath)
+	}
 	for k, v := range extraEnv {
 		env = append(env, fmt.Sprintf("%s=%s", k, v))
 	}

internal/cli/main_test.go

@@ -0,0 +1,36 @@
+package cli
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func TestMain(m *testing.M) {
+	// Tests supply their own overrides; inherited settings must not affect them.
+	for _, entry := range os.Environ() {
+		key, _, _ := strings.Cut(entry, "=")
+		if strings.HasPrefix(key, "AUDITA_") || key == "OPENROUTER_API_KEY" {
+			if err := os.Unsetenv(key); err != nil {
+				panic(err)
+			}
+		}
+	}
+
+	dir, err := os.MkdirTemp("", "audita-cli-test-config-")
+	if err != nil {
+		panic(err)
+	}
+	defer os.RemoveAll(dir)
+	configPath := filepath.Join(dir, "config.yml")
+	if err := os.WriteFile(configPath, []byte("version: 1\n"), 0600); err != nil {
+		panic(err)
+	}
+	// An explicit environment path prevents discovery of installed system config.
+	// Individual tests can still override it with t.Setenv or --config.
+	if err := os.Setenv("AUDITA_CONFIG", configPath); err != nil {
+		panic(err)
+	}
+	m.Run()
+}

internal/cli/run_test.go

@@ -1173,6 +1173,15 @@ func waitForAtomicAtLeast(t *testing.T, value *int32, want int32) {
 }
 
 func TestRunProcessReportJSONSuccessIncludesNormalizationSummary(t *testing.T) {
+	// Exercise the no-config metadata contract without consulting system files.
+	t.Setenv("AUDITA_CONFIG", "")
+	if err := os.Unsetenv("AUDITA_CONFIG"); err != nil {
+		t.Fatal(err)
+	}
+	searchPaths := config.DefaultConfigSearchPaths
+	config.DefaultConfigSearchPaths = nil
+	t.Cleanup(func() { config.DefaultConfigSearchPaths = searchPaths })
+
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
 
@@ -1350,7 +1359,7 @@ func TestRunProcessReportJSONAndRunDirReportShareDiagnosticsMetadata(t *testing.
 	if externalReport.Diagnostics == nil || runDirReport.Diagnostics == nil {
 		t.Fatalf("expected diagnostics metadata in both reports")
 	}
-	if externalReport.ReportMetadata != runDirReport.ReportMetadata {
+	if !reflect.DeepEqual(externalReport.ReportMetadata, runDirReport.ReportMetadata) {
 		t.Fatalf("expected same report metadata in --report-json and run-dir report\nexternal=%+v\nrun-dir=%+v",
 			externalReport.ReportMetadata, runDirReport.ReportMetadata)
 	}