test(archsetup): scaffold Testinfra post-install validation (P1)

Stand up the Testinfra/pytest harness alongside the existing shell sweep so the two can be compared for parity before pytest takes over.

Adds scripts/testing/tests/ (conftest with failure attribution markers, a report hook, and a target_user fixture, plus three parity checks: user, ufw, dotfiles) and scripts/testing/lib/testinfra.sh, which injects a throwaway SSH key into the VM and runs pytest over SSH. The sweep is advisory here (RUN_TESTINFRA toggle, non-fatal) and does not yet affect pass/fail. Pulls python-pytest and python-pytest-testinfra into make deps.

Verified on the host: py_compile clean, pytest --collect-only green, bash -n and shellcheck clean. The sweep running against a real VM is verified by the next make test run.

1 files changed, 72 insertions, 0 deletions

diff --git a/scripts/testing/tests/conftest.py b/scripts/testing/tests/conftest.py
new file mode 100644
index 0000000..00632b6
--- /dev/null
+++ b/scripts/testing/tests/conftest.py
@@ -0,0 +1,72 @@
+# SPDX-License-Identifier: GPL-3.0-or-later
+"""Pytest + Testinfra config for archsetup post-install validation.
+
+These tests run on the *host* and connect to the freshly-installed VM over SSH
+(Testinfra provides the `host` fixture, parametrized from --hosts). This file
+adds two things the bespoke shell harness had that Testinfra does not:
+
+  - Failure attribution. Each check is marked with the layer that owns a
+    failure (archsetup | base_install | unknown), mirroring validation.sh's
+    attribute_issue. Failures are bucketed and written to --attribution-file
+    so run-test.sh can route base-install issues to the archzfs inbox as before.
+  - Tiering markers (smoke | integration) so `pytest -m smoke` is a fast gate.
+
+The `target_user` fixture supplies the account archsetup created; it reads
+ARCHSETUP_TEST_USER (set by run-test.sh from the VM conf) and defaults to the
+historical "cjennings".
+"""
+
+import os
+
+import pytest
+
+
+_ATTRIBUTION_BUCKETS = ("archsetup", "base_install", "unknown")
+_failures = {bucket: [] for bucket in _ATTRIBUTION_BUCKETS}
+
+
+def pytest_addoption(parser):
+    parser.addoption(
+        "--attribution-file",
+        action="store",
+        default=None,
+        help="write the failure attribution report (archsetup/base_install/unknown) here",
+    )
+
+
+def pytest_configure(config):
+    config.addinivalue_line(
+        "markers",
+        "attribution(bucket): layer that owns a failure — archsetup, base_install, or unknown",
+    )
+    config.addinivalue_line("markers", "smoke: fast subset (user, key packages, dotfiles present)")
+    config.addinivalue_line("markers", "integration: full post-install checks")
+
+
+@pytest.hookimpl(wrapper=True)
+def pytest_runtest_makereport(item, call):
+    report = yield
+    if report.when == "call" and report.failed:
+        marker = item.get_closest_marker("attribution")
+        bucket = marker.args[0] if (marker and marker.args) else "archsetup"
+        if bucket not in _failures:
+            bucket = "unknown"
+        _failures[bucket].append(item.nodeid)
+    return report
+
+
+def pytest_sessionfinish(session, exitstatus):
+    path = session.config.getoption("--attribution-file")
+    if not path:
+        return
+    with open(path, "w") as fh:
+        for bucket in _ATTRIBUTION_BUCKETS:
+            fh.write("[%s]\n" % bucket)
+            for nodeid in _failures[bucket]:
+                fh.write("  %s\n" % nodeid)
+
+
+@pytest.fixture(scope="session")
+def target_user():
+    """The account archsetup created in the VM under test."""
+    return os.environ.get("ARCHSETUP_TEST_USER", "cjennings")