test(archsetup): scaffold Testinfra post-install validation (P1)

Stand up the Testinfra/pytest harness alongside the existing shell sweep so the two can be compared for parity before pytest takes over.

Adds scripts/testing/tests/ (conftest with failure attribution markers, a report hook, and a target_user fixture, plus three parity checks: user, ufw, dotfiles) and scripts/testing/lib/testinfra.sh, which injects a throwaway SSH key into the VM and runs pytest over SSH. The sweep is advisory here (RUN_TESTINFRA toggle, non-fatal) and does not yet affect pass/fail. Pulls python-pytest and python-pytest-testinfra into make deps.

Verified on the host: py_compile clean, pytest --collect-only green, bash -n and shellcheck clean. The sweep running against a real VM is verified by the next make test run.

4 files changed, 122 insertions, 0 deletions

diff --git a/scripts/testing/tests/conftest.py b/scripts/testing/tests/conftest.py
new file mode 100644
index 0000000..00632b6
--- /dev/null
+++ b/scripts/testing/tests/conftest.py
@@ -0,0 +1,72 @@
+# SPDX-License-Identifier: GPL-3.0-or-later
+"""Pytest + Testinfra config for archsetup post-install validation.
+
+These tests run on the *host* and connect to the freshly-installed VM over SSH
+(Testinfra provides the `host` fixture, parametrized from --hosts). This file
+adds two things the bespoke shell harness had that Testinfra does not:
+
+  - Failure attribution. Each check is marked with the layer that owns a
+    failure (archsetup | base_install | unknown), mirroring validation.sh's
+    attribute_issue. Failures are bucketed and written to --attribution-file
+    so run-test.sh can route base-install issues to the archzfs inbox as before.
+  - Tiering markers (smoke | integration) so `pytest -m smoke` is a fast gate.
+
+The `target_user` fixture supplies the account archsetup created; it reads
+ARCHSETUP_TEST_USER (set by run-test.sh from the VM conf) and defaults to the
+historical "cjennings".
+"""
+
+import os
+
+import pytest
+
+
+_ATTRIBUTION_BUCKETS = ("archsetup", "base_install", "unknown")
+_failures = {bucket: [] for bucket in _ATTRIBUTION_BUCKETS}
+
+
+def pytest_addoption(parser):
+    parser.addoption(
+        "--attribution-file",
+        action="store",
+        default=None,
+        help="write the failure attribution report (archsetup/base_install/unknown) here",
+    )
+
+
+def pytest_configure(config):
+    config.addinivalue_line(
+        "markers",
+        "attribution(bucket): layer that owns a failure — archsetup, base_install, or unknown",
+    )
+    config.addinivalue_line("markers", "smoke: fast subset (user, key packages, dotfiles present)")
+    config.addinivalue_line("markers", "integration: full post-install checks")
+
+
+@pytest.hookimpl(wrapper=True)
+def pytest_runtest_makereport(item, call):
+    report = yield
+    if report.when == "call" and report.failed:
+        marker = item.get_closest_marker("attribution")
+        bucket = marker.args[0] if (marker and marker.args) else "archsetup"
+        if bucket not in _failures:
+            bucket = "unknown"
+        _failures[bucket].append(item.nodeid)
+    return report
+
+
+def pytest_sessionfinish(session, exitstatus):
+    path = session.config.getoption("--attribution-file")
+    if not path:
+        return
+    with open(path, "w") as fh:
+        for bucket in _ATTRIBUTION_BUCKETS:
+            fh.write("[%s]\n" % bucket)
+            for nodeid in _failures[bucket]:
+                fh.write("  %s\n" % nodeid)
+
+
+@pytest.fixture(scope="session")
+def target_user():
+    """The account archsetup created in the VM under test."""
+    return os.environ.get("ARCHSETUP_TEST_USER", "cjennings")
diff --git a/scripts/testing/tests/test_dotfiles.py b/scripts/testing/tests/test_dotfiles.py
new file mode 100644
index 0000000..cd6e474
--- /dev/null
+++ b/scripts/testing/tests/test_dotfiles.py
@@ -0,0 +1,19 @@
+# SPDX-License-Identifier: GPL-3.0-or-later
+"""Post-install checks: dotfiles stowed for the user.
+
+Parity port of validate_dotfiles from validation.sh: .zshrc must be a symlink
+into the ~/.dotfiles stow tree, not broken, and readable by the user (not just
+root).
+"""
+
+import pytest
+
+
+@pytest.mark.attribution("archsetup")
+def test_zshrc_stowed_and_readable(host, target_user):
+    zshrc = host.file("/home/%s/.zshrc" % target_user)
+    assert zshrc.is_symlink, ".zshrc should be a stow symlink"
+    assert ".dotfiles/" in zshrc.linked_to, "symlink should point into ~/.dotfiles"
+    assert zshrc.exists, "symlink target must exist (not broken)"
+    # Readable by the user, not only root.
+    assert host.run("sudo -u %s test -r %s" % (target_user, zshrc.path)).rc == 0
diff --git a/scripts/testing/tests/test_services.py b/scripts/testing/tests/test_services.py
new file mode 100644
index 0000000..dc89e74
--- /dev/null
+++ b/scripts/testing/tests/test_services.py
@@ -0,0 +1,13 @@
+# SPDX-License-Identifier: GPL-3.0-or-later
+"""Post-install checks: essential services archsetup enables.
+
+Parity port of validate_firewall from validation.sh (more to follow in P2).
+"""
+
+import pytest
+
+
+@pytest.mark.smoke
+@pytest.mark.attribution("archsetup")
+def test_ufw_firewall_enabled(host):
+    assert host.service("ufw").is_enabled
diff --git a/scripts/testing/tests/test_users.py b/scripts/testing/tests/test_users.py
new file mode 100644
index 0000000..92ce768
--- /dev/null
+++ b/scripts/testing/tests/test_users.py
@@ -0,0 +1,18 @@
+# SPDX-License-Identifier: GPL-3.0-or-later
+"""Post-install checks: the user account archsetup creates.
+
+Parity port of validate_user_created / validate_user_shell from validation.sh.
+"""
+
+import pytest
+
+
+@pytest.mark.smoke
+@pytest.mark.attribution("archsetup")
+def test_user_exists(host, target_user):
+    assert host.user(target_user).exists
+
+
+@pytest.mark.attribution("archsetup")
+def test_user_shell_is_zsh(host, target_user):
+    assert host.user(target_user).shell == "/usr/bin/zsh"