Fixes and cleanup after implementation of the S3 and SSH roadmap

internal/app/run_test.go

@@ -49,6 +49,45 @@ func TestRunDryRunPrintsConfigSummary(t *testing.T) {
 	}
 }
 
+func TestRunDryRunUsesReadOnlySSHKnownHosts(t *testing.T) {
+	sourceRoot := t.TempDir()
+	writeSourceBundle(t, sourceRoot, "", testBundleOptions{})
+	cfg := config.Config{Pipelines: []config.Pipeline{{
+		ID:     "reports",
+		Source: config.Backend{Backend: config.BackendLocal, Path: sourceRoot},
+		Destinations: []config.Destination{{
+			ID:      "archive",
+			Backend: config.BackendSSH,
+			Host:    "destination.example.com",
+			Path:    "/archive",
+		}},
+	}}}
+	config.ApplyDefaults(&cfg)
+	var got storage.OpenConfig
+	provider := func(environment config.Environment) *backendFactory {
+		registry := storage.NewRegistry()
+		if err := registry.Register(config.BackendLocal, func(ctx context.Context, cfg storage.OpenConfig) (storage.Backend, error) {
+			return local.New(cfg[storagePathKey])
+		}); err != nil {
+			t.Fatalf("register local backend: %v", err)
+		}
+		if err := registry.Register(config.BackendSSH, func(ctx context.Context, cfg storage.OpenConfig) (storage.Backend, error) {
+			got = cfg
+			return fake.New(), nil
+		}); err != nil {
+			t.Fatalf("register ssh backend: %v", err)
+		}
+		return &backendFactory{registry: registry, environment: environment}
+	}
+
+	if err := runConfigWithBackendFactory(context.Background(), cfg, RunOptions{DryRun: true}, provider); err != nil {
+		t.Fatalf("runConfigWithBackendFactory() error = %v", err)
+	}
+	if got[sshReadOnlyHostsKey] != "true" {
+		t.Fatalf("open config %s = %q, want true", sshReadOnlyHostsKey, got[sshReadOnlyHostsKey])
+	}
+}
+
 func TestRunLoadsSecretsBeforeOpeningBackends(t *testing.T) {
 	sourceRoot := filepath.Join(t.TempDir(), "missing-source")
 	destinationRoot := t.TempDir()