test: enforce strict replay sandboxing in e2e fixtures

[sohankshirsagar]

Summary

Enable strict replay sandboxing across the Python e2e and stack-test fixtures so local/CI replay runs exercise the sandboxed path instead of silently falling back. This also updates sandbox-sensitive HTTP fixtures to install SOCKS support, since strict replay routes outbound HTTP through a SOCKS proxy.

Changes

• set replay.sandbox.mode: strict in all checked-in e2e and stack-test .tusk/config.yaml fixtures
• add the required Docker sandbox permissions to each app service in the test docker-compose.yml files:
  • cap_add: [SYS_ADMIN]
  • security_opt: [seccomp=unconfined, apparmor=unconfined]
• install bubblewrap and socat in the shared python-e2e-base image used by the test containers
• update the httpx and fastapi e2e test requirements to use httpx[socks] and document why that extra is needed under strict replay sandboxing
• keep the fixture changes centralized in shared test infrastructure where possible rather than duplicating setup per test image

Notes

• strict sandbox replay exposed protocol-specific fixture requirements rather than changing app logic
• httpx-based fixtures needed SOCKS support because replay now intercepts outbound HTTP through a SOCKS proxy

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

[tusk-dev]

PR identified as a refactor

Tip

New to Tusk Unit Tests? Learn more here.

View check history

Commit	Status	Output	Created (UTC)
fa4ef5d	PR identified as a refactor	Output	Mar 19, 2026 12:09AM

[cubic-dev-ai]

1 issue found across 40 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="drift/instrumentation/grpc/e2e-tests/src/greeter_pb2_grpc.py">

<violation number="1" location="drift/instrumentation/grpc/e2e-tests/src/greeter_pb2_grpc.py:8">
P2: This raises the generated gRPC minimum version to 1.78.0, but the fixture requirements still allow grpcio 1.60+. Align dependency constraints (or regenerate with the intended toolchain) to avoid import-time RuntimeError on environments that resolve <1.78.0.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[cubic-dev-ai]

3 issues found across 1 file (changes from recent commits).

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name=".github/workflows/e2e.yml">

<violation number="1" location=".github/workflows/e2e.yml:131">
P2: This artifact upload points into `.tusk`, but `upload-artifact@v4` ignores hidden directories by default, so these replay logs will be silently skipped unless you opt in to hidden files.</violation>

<violation number="2" location=".github/workflows/e2e.yml:232">
P2: This upload has the same hidden-directory problem: `.tusk/logs/*` is excluded by `upload-artifact@v4` unless `include-hidden-files` is enabled.</violation>

<violation number="3" location=".github/workflows/e2e.yml:326">
P2: This upload step will also skip the replay logs, because `.tusk` is hidden and `upload-artifact@v4` does not include hidden files by default.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[cubic-dev-ai]

1 issue found across 3 files (changes from recent commits).

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name=".github/workflows/e2e.yml">

<violation number="1" location=".github/workflows/e2e.yml:17">
P2: The workflow is pinned to a temporary feature branch (`socket-location`) for the CLI under test, which makes CI results unstable and can break all e2e jobs if that branch changes or is removed.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}