test: adopt -Werror in unit tests

haproxy-ddos-protection-configurator/pyproject.toml

@@ -102,6 +102,10 @@ skip = "build,lib,venv,icon.svg,.tox,.git,.mypy_cache,.ruff_cache,.coverage,html
 [tool.pytest.ini_options]
 minversion = "6.0"
 log_cli_level = "INFO"
+# promote warnings to test failures
+filterwarnings = [
+  "error",
+]
 
 [tool.coverage.run]
 branch = true

haproxy-ddos-protection-configurator/tox.toml

@@ -129,6 +129,8 @@ commands = [
     "--ignore={toxinidir}/haproxy-operator",
     "--log-cli-level=INFO",
     "-s",
+    # Don't promote warnings for integration tests
+    "--override-ini=filterwarnings=",
     { replace = "posargs", extend = "true" },
   ],
 ]

haproxy-operator/pyproject.toml

@@ -117,6 +117,10 @@ ignore-words-list = "iif"
 [tool.pytest.ini_options]
 minversion = "6.0"
 log_cli_level = "INFO"
+# promote warnings to test failures
+filterwarnings = [
+  "error",
+]
 
 [tool.coverage.run]
 branch = true

haproxy-operator/tests/unit/conftest.py

@@ -16,10 +16,6 @@
     CertificateRequestAttributes,
     CertificateSigningRequest,
     PrivateKey,
-    generate_ca,
-    generate_certificate,
-    generate_csr,
-    generate_private_key,
 )
 from charms.haproxy.v0.spoe_auth import SpoeAuthProviderAppData, SpoeAuthProviderUnitData
 from charms.haproxy.v1.haproxy_route_tcp import (
@@ -80,8 +76,12 @@ def mocks_tls_ca_write_fixture(monkeypatch: pytest.MonkeyPatch):
 @pytest.fixture(scope="function", name="ca_certificate_and_key")
 def ca_certificate_and_key_fixture() -> typing.Tuple[Certificate, PrivateKey]:
     """Ca Certificate and private key."""
-    private_key_ca = generate_private_key()
-    ca = generate_ca(generate_private_key(), timedelta(days=10), "caname")
+    private_key_ca = PrivateKey.generate()
+    ca = Certificate.generate_self_signed_ca(
+        CertificateRequestAttributes(common_name="caname", is_ca=True),
+        private_key_ca,
+        timedelta(days=10),
+    )
     return ca, private_key_ca
 
 
@@ -91,9 +91,12 @@ def csr_certificate_and_key_fixture(
 ) -> typing.Tuple[CertificateSigningRequest, Certificate, PrivateKey]:
     """Ca Certificate and private key."""
     ca, private_key_ca = ca_certificate_and_key
-    private_key = generate_private_key()
-    csr = generate_csr(private_key, TEST_EXTERNAL_HOSTNAME_CONFIG)
-    certificate = generate_certificate(csr, ca, private_key_ca, timedelta(days=5))
+    private_key = PrivateKey.generate()
+    csr_attributes = CertificateRequestAttributes(common_name=TEST_EXTERNAL_HOSTNAME_CONFIG)
+    csr = csr_attributes.generate_csr(private_key)
+    certificate = Certificate.generate(
+        csr=csr, ca=ca, ca_private_key=private_key_ca, validity=timedelta(days=5)
+    )
     return csr, certificate, private_key
 
 

haproxy-operator/tests/unit/legacy/test_ha.py

@@ -8,6 +8,12 @@
 
 from state.ha import HACLUSTER_INTEGRATION, HAInformation, HAInformationValidationError
 
+# These legacy tests still use Harness, which ops marks as deprecated with a
+# PendingDeprecationWarning. The unit suite runs with warnings promoted to
+# errors (see pyproject.toml), so ignore that one warning here until the tests
+# are ported to ops.testing.Context like the rest of tests/unit.
+pytestmark = pytest.mark.filterwarnings("ignore:Harness is deprecated:PendingDeprecationWarning")
+
 
 def test_ha_information(harness: Harness):
     """

haproxy-operator/tests/unit/legacy/test_haproxy_route_lib.py

@@ -26,6 +26,12 @@
 from ops.testing import Harness
 from pydantic import ValidationError
 
+# These legacy tests still use Harness, which ops marks as deprecated with a
+# PendingDeprecationWarning. The unit suite runs with warnings promoted to
+# errors (see pyproject.toml), so ignore that one warning here until the tests
+# are ported to ops.testing.Context like the rest of tests/unit.
+pytestmark = pytest.mark.filterwarnings("ignore:Harness is deprecated:PendingDeprecationWarning")
+
 logger = logging.getLogger()
 MOCK_RELATION_NAME = "haproxy-route"
 MOCK_ADDRESS = "10.0.0.1"
@@ -67,8 +73,10 @@ def mock_provider_app_data_fixture():
 
 @pytest.fixture(name="mock_requirer_charm")
 def mock_requirer_charm_fixture():
-    """Create mock unit data."""
-    return Harness(ops.CharmBase, meta=MOCK_REQUIRER_CHARM_META)
+    """Create a harness for a mock requirer charm and clean up its files afterwards."""
+    harness = Harness(ops.CharmBase, meta=MOCK_REQUIRER_CHARM_META)
+    yield harness
+    harness.cleanup()
 
 
 def test_requirer_application_data_validation():

haproxy-operator/tests/unit/legacy/test_tls_relation.py

@@ -17,6 +17,12 @@
 from state.tls import HaproxyPeerRelationAppData, TLSInformation, TLSNotReadyError
 from tls_relation import TLSRelationService
 
+# These legacy tests still use Harness, which ops marks as deprecated with a
+# PendingDeprecationWarning. The unit suite runs with warnings promoted to
+# errors (see pyproject.toml), so ignore that one warning here until the tests
+# are ported to ops.testing.Context like the rest of tests/unit.
+pytestmark = pytest.mark.filterwarnings("ignore:Harness is deprecated:PendingDeprecationWarning")
+
 TEST_EXTERNAL_HOSTNAME_CONFIG = "haproxy.internal"
 
 

haproxy-operator/tox.toml

@@ -125,6 +125,8 @@ commands = [
     "--ignore={toxinidir}/haproxy_spoe_auth_operator",
     "--log-cli-level=INFO",
     "-s",
+    # Don't promote warnings for integration tests
+    "--override-ini=filterwarnings=",
     { replace = "posargs", extend = "true" },
   ],
 ]

haproxy-route-policy-operator/pyproject.toml

@@ -85,6 +85,13 @@ skip = "build,lib,venv,icon.svg,.tox,.git,.mypy_cache,.ruff_cache,.coverage,html
 [tool.pytest.ini_options]
 minversion = "6.0"
 log_cli_level = "INFO"
+# promote warnings to test failures
+filterwarnings = [
+  "error",
+  # Raised by the vendored data_platform_libs charm lib; the fix belongs
+  # upstream in canonical/data-platform-libs.
+  "ignore:JujuVersion.from_environ\\(\\) is deprecated:DeprecationWarning",
+]
 
 [tool.coverage.run]
 branch = true

haproxy-route-policy-operator/tox.toml

@@ -129,6 +129,8 @@ commands = [
     "--ignore={[vars]tst_path}unit",
     "--log-cli-level=INFO",
     "-s",
+    # Don't promote warnings for integration tests
+    "--override-ini=filterwarnings=",
     { replace = "posargs", extend = "true" },
   ],
 ]

haproxy-route-policy/haproxy_route_policy/test_settings.py

@@ -21,3 +21,9 @@
         "rest_framework.permissions.AllowAny",
     ],
 }
+
+# The tests run without `collectstatic`, so STATIC_ROOT does not exist and
+# WhiteNoise would warn "No directory at ..." when its middleware starts. The
+# unit tox envs promote warnings to errors, so serve static files on demand
+# instead of from a pre-collected directory.
+WHITENOISE_AUTOREFRESH = True

haproxy-route-policy/haproxy_route_policy/test_settings_authenticated.py

@@ -14,3 +14,9 @@
         "NAME": ":memory:",
     }
 }
+
+# The tests run without `collectstatic`, so STATIC_ROOT does not exist and
+# WhiteNoise would warn "No directory at ..." when its middleware starts. The
+# unit tox envs promote warnings to errors, so serve static files on demand
+# instead of from a pre-collected directory.
+WHITENOISE_AUTOREFRESH = True

haproxy-route-policy/tox.toml

@@ -18,8 +18,15 @@ PY_COLORS = "1"
 
 [env.unit]
 description = "Run unit tests"
+# -W error promotes every Python warning to a test failure, mirroring the
+# filterwarnings = ["error"] setting the charms in this repository use with
+# pytest; Django's test runner has no equivalent setting of its own.
 commands = [
   [
+    "python",
+    "-W",
+    "error",
+    "-m",
     "coverage",
     "run",
     "manage.py",
@@ -37,6 +44,10 @@ dependency_groups = ["unit"]
 description = "Run auth unit tests"
 commands = [
   [
+    "python",
+    "-W",
+    "error",
+    "-m",
     "coverage",
     "run",
     "manage.py",

haproxy-spoe-auth-operator/pyproject.toml

@@ -114,6 +114,10 @@ skip = "build,lib,venv,icon.svg,.tox,.git,.mypy_cache,.ruff_cache,.coverage,html
 [tool.pytest.ini_options]
 minversion = "6.0"
 log_cli_level = "INFO"
+# promote warnings to test failures
+filterwarnings = [
+  "error",
+]
 
 [tool.coverage.run]
 branch = true

haproxy-spoe-auth-operator/tox.toml

@@ -120,6 +120,8 @@ commands = [
     "--ignore={[vars]tst_path}unit",
     "--log-cli-level=INFO",
     "-s",
+    # Don't promote warnings for integration tests
+    "--override-ini=filterwarnings=",
     { replace = "posargs", extend = "true" },
   ],
 ]