🧪 Gate secure-storage tests by marker

Register `requires_secure_storage` and mark tests which need a system
password manager backend. Skip those tests unless the marker is
explicitly selected so local runs do not fail on machines without usable
secure storage.

CI selects the marker so keyring misconfiguration still causes a normal
test failure instead of silently losing coverage.

Author: agoscinski

.github/workflows/ci-code.yml

@@ -73,7 +73,7 @@ jobs:
         AIIDA_TEST_PROFILE: test_aiida
         AIIDA_WARN_v3: 1
       run: |
-        pytest -n auto --db-backend ${{ matrix.database-backend }} --broker-backend ${{ matrix.broker-backend }} -m 'not nightly' tests/ ${{ matrix.python-version == '3.14' && '--cov aiida' || '' }}
+        pytest -n auto --db-backend ${{ matrix.database-backend }} --broker-backend ${{ matrix.broker-backend }} -m 'not nightly or requires_secure_storage' tests/ ${{ matrix.python-version == '3.14' && '--cov aiida' || '' }}
 
     - name: Upload coverage report
       if: matrix.python-version == 3.14 && github.repository == 'aiidateam/aiida-core'
@@ -125,7 +125,7 @@ jobs:
     - name: Run test suite
       env:
         AIIDA_WARN_v3: 0
-      run: pytest --disable-warnings -n auto --db-backend ${{ matrix.database-backend }} --broker-backend zmq -m 'not nightly' tests/
+      run: pytest --disable-warnings -n auto --db-backend ${{ matrix.database-backend }} --broker-backend zmq -m 'not nightly or requires_secure_storage' tests/
 
 
   tests-presto:

.github/workflows/test-install.yml

@@ -215,7 +215,7 @@ jobs:
         AIIDA_TEST_PROFILE: test_aiida
         AIIDA_WARN_v3: 1
       run: |
-        pytest -n auto --db-backend psql -m 'not nightly' tests/
+        pytest -n auto --db-backend psql -m 'not nightly or requires_secure_storage' tests/
 
     - name: Slack notification
       # Run this step if any of the previous steps fail.

pyproject.toml

@@ -444,7 +444,8 @@ markers = [
   'requires_rmq: requires RabbitMQ specifically (not compatible with ZeroMQ broker)',
   'requires_broker: requires a message broker (RabbitMQ or ZeroMQ)',
   'requires_psql: requires a connection to PostgreSQL DB',
-  'presto: automatic marker for tests needing no external services (not requires_rmq, not requires_psql)',
+  'requires_secure_storage: requires a system secure storage backend',
+  'presto: automatic marker for tests needing no external services (not requires_rmq, not requires_psql, not requires_secure_storage)',
   'sphinx: set parameters for the sphinx `app` fixture'
 ]
 minversion = '7.0'

tests/conftest.py

@@ -69,13 +69,14 @@ def pytest_collection_modifyitems(items, config):
     """Automatically generate markers for certain tests.
 
     Most notably, we add the 'presto' marker for all tests that
-    are not marked with requires_rmq, requires_psql, or nightly.
+    are not marked with requires_rmq, requires_psql, requires_secure_storage, or nightly.
     Tests marked requires_broker are included in presto since ZeroMQ
     broker is available without external services.
     """
     filepath_psqldos = Path(__file__).parent / 'storage' / 'psql_dos'
     filepath_django = Path(__file__).parent / 'storage' / 'psql_dos' / 'migrations' / 'django_branch'
     filepath_sqla = Path(__file__).parent / 'storage' / 'psql_dos' / 'migrations' / 'sqlalchemy_branch'
+    user_markexpr = config.option.markexpr
 
     # If the user requested the SQLite backend, automatically skip incompatible tests
     if config.option.db_backend is TestDbBackend.SQLITE:
@@ -118,11 +119,20 @@ def pytest_collection_modifyitems(items, config):
         if filepath_item.is_relative_to(filepath_psqldos):
             item.add_marker('requires_psql')
 
+        markers = [marker.name for marker in item.iter_markers()]
+
+        if 'requires_secure_storage' in markers and 'requires_secure_storage' not in user_markexpr:
+            item.add_marker(pytest.mark.skip(reason='requires secure storage; select with -m requires_secure_storage'))
+
         # Add 'presto' marker to tests that don't need external services.
         # Tests with requires_broker ARE included (ZeroMQ broker needs no external service).
-        # Tests with requires_rmq, requires_psql, or nightly are excluded.
-        markers = [marker.name for marker in item.iter_markers()]
-        if 'requires_rmq' not in markers and 'requires_psql' not in markers and 'nightly' not in markers:
+        # Tests with requires_rmq, requires_psql, requires_secure_storage, or nightly are excluded.
+        if (
+            'requires_rmq' not in markers
+            and 'requires_psql' not in markers
+            and 'requires_secure_storage' not in markers
+            and 'nightly' not in markers
+        ):
             item.add_marker('presto')
 
 

tests/orm/test_authinfos.py

@@ -18,6 +18,7 @@
 from aiida.orm.implementation.authinfos import BackendAuthInfo
 
 
+@pytest.mark.requires_secure_storage
 class TestAuthinfo:
     """Unit tests for the AuthInfo ORM class."""
 

tests/transports/test_all_plugins.py

@@ -67,7 +67,7 @@ def tmp_path_local(tmp_path_factory):
         ('core.ssh_async', 'asyncssh'),
         ('core.ssh_async', 'openssh'),
         ('core.ssh_async', 'password-passed'),
-        ('core.ssh_async', 'password-from-keychain'),
+        pytest.param(('core.ssh_async', 'password-from-keychain'), marks=pytest.mark.requires_secure_storage),
     ],
 )
 def custom_transport(request, aiida_localhost) -> Transport: