fix(tests): read integration test API key from LANDINGAI_API_KEY secret - #271
Merged
Conversation
The e2e predict tests carried a hardcoded LandingLens API key. Read it from the LANDINGAI_API_KEY environment variable instead, populated in CI from the repository secret of the same name. Secrets are not exposed to workflow runs triggered by pull requests from forks, so the tests skip themselves when the key is absent rather than failing with a 401.
Exporting LANDINGAI_API_KEY for the whole pytest run leaks it into the unit tests that cover credential loading. Environment variables take precedence over .env files, so those tests read the real key instead of the one they set up, and the tests asserting that a missing or invalid key raises found a valid one instead. Clear the credential env vars before each unit test. Tests that need a credential still set it themselves.
hrnn
enabled auto-merge (squash)
August 13, 2026 18:57
hrnn
disabled auto-merge
August 13, 2026 19:05
There was a problem hiding this comment.
Pull request overview
Moves live integration-test authentication from a hardcoded key to a rotatable CI secret.
Changes:
- Reads
LANDINGAI_API_KEYfrom the environment. - Skips live tests when the secret is unavailable.
- Isolates unit tests from ambient credentials.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
.github/workflows/ci_cd.yml |
Supplies the repository secret to pytest. |
tests/integration/landingai/test_predict_e2e.py |
Loads the key from the environment and skips when absent. |
tests/unit/conftest.py |
Clears ambient credential variables for unit tests. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
The e2e predict tests carried a hardcoded LandingLens API key at the top of
tests/integration/landingai/test_predict_e2e.py. This reads it from theLANDINGAI_API_KEYenvironment variable instead, populated in CI from therepository secret of the same name.
Why
CI has been red since the hardcoded key stopped resolving to a user record —
all five live-endpoint tests failed with
401 UNAUTHORIZED(
Failed to find user record with apiKey: land_sk_aMemW***), which cancelledthe whole 12-job matrix and blocked
Release. With the key in source there wasno way to rotate it without a code change.
Fork PRs
Repository secrets are not exposed to workflow runs triggered by pull requests
from forks, and this repo is public with 59 of them. So the tests skip
themselves when the key is empty rather than failing with a 401 that external
contributors cannot act on:
Both paths verified locally against the live endpoints.