expenses_manager/Jenkinsfile

@@ -4,11 +4,6 @@ pipeline {
     agent none
 
     environment {
-        DEBUG = 'True'
-        SECRET_KEY = 'ci-only-value-never-used-in-production'
-        DJANGO_SETTINGS_MODULE = 'expenses_manager.settings'
-        PYTHONUNBUFFERED = '1'
-
         // Jenkins has no Docker daemon, so everything Docker-related happens on
         // the NAS over SSH. Absolute paths are required: the remote
         // non-interactive PATH does not include /usr/local/bin.
@@ -73,6 +68,7 @@ pipeline {
                 }
 
                 // Catches models changed without generating the migration.
+                                // Catches models changed without generating the migration.
                 stage('Check migrations') {
                     steps {
                         sshagent(credentials: ['nas-ssh']) {
@@ -81,7 +77,9 @@ pipeline {
                                 ssh ${SSH_OPTS} ${NAS_USER}@${NAS_HOST} \
                                     "sudo ${NAS_DOCKER} run --rm \
                                         -e SECRET_KEY=ci-only-value \
-                                        -e DEBUG=True \
+                                        -e DEBUG=False \
+                                        -e ALLOWED_HOSTS=localhost,testserver \
+                                        -e DJANGO_SETTINGS_MODULE=expenses_manager.settings_test \
                                         -e DB_ENGINE=sqlite3 \
                                         ${IMAGE}-test:${SHA} \
                                         python manage.py makemigrations --check --dry-run"
@@ -95,31 +93,30 @@ pipeline {
                         sshagent(credentials: ['nas-ssh']) {
                             // pytest output goes to stderr so it shows up in this log,
                             // while stdout carries only the JUnit XML. That avoids
-                            // copying a root-owned file back from the NAS, which
-                            // jenkins-ci could not read.
+                            // copying a root-owned file back from the NAS.
                             sh '''
                                 SHA=$(echo "${GIT_COMMIT}" | cut -c1-7)
                                 ssh ${SSH_OPTS} ${NAS_USER}@${NAS_HOST} \
                                     "sudo ${NAS_DOCKER} run --rm \
                                         -e SECRET_KEY=ci-only-value \
-                                        -e DEBUG=True \
+                                        -e DEBUG=False \
+                                        -e ALLOWED_HOSTS=localhost,testserver \
+                                        -e DJANGO_SETTINGS_MODULE=expenses_manager.settings_test \
                                         -e DB_ENGINE=sqlite3 \
                                         ${IMAGE}-test:${SHA} \
                                         sh -c 'pytest --cov --junitxml=/tmp/junit.xml >&2; \
-                                            rc=\\$?; cat /tmp/junit.xml; exit \\$rc'" \
+                                                rc=\\$?; cat /tmp/junit.xml; exit \\$rc'" \
                                     > junit.xml
                             '''
                         }
                     }
                     post {
                         always {
-                            // allowEmptyResults: false is deliberate. A build where
-                            // pytest died before collecting anything produces no XML,
-                            // and that must fail rather than pass quietly.
                             junit allowEmptyResults: false, testResults: 'junit.xml'
                         }
                     }
                 }
+                }
 
                 stage('Smoke test image') {
                     steps {

expenses_manager/expenses_manager/settings_test.py

@@ -0,0 +1,11 @@
+"""Settings for the test suite.
+
+Inherits the production configuration so tests exercise what actually runs on
+the NAS — DEBUG off, secure cookies, WhiteNoise storage — and turns off only
+what makes Django's test client unusable: SECURE_SSL_REDIRECT answers every
+request with a 301 before the view is ever reached.
+"""
+
+from .settings import *  # noqa: F401,F403
+
+SECURE_SSL_REDIRECT = False

expenses_manager/pytest.ini

@@ -1,3 +1,3 @@
 [pytest]
-DJANGO_SETTINGS_MODULE = expenses_manager.settings
+DJANGO_SETTINGS_MODULE = expenses_manager.settings_test
 python_files = tests.py test_*.py *_tests.py