fix(tests): isolate rendered projects from the harness interpreter pin

The generation tests render a project and run copier's copy-time `uv
lock`/`uv sync` _tasks. `just test` runs under `uv run` (which exports
VIRTUAL_ENV) and the CI matrix's astral-sh/setup-uv exports
UV_PYTHON=<matrix python>; both leak into those subprocesses and pin the
rendered project to the maintainer's interpreter instead of its own
requires-python. Every matrix Python older than the rendered
python_version (default 3.13) then aborts `uv lock` with "incompatible
with the project's Python requirement". The first CI run failed all
3.11/3.12 jobs this way; the local 3.13-only run masked it.

Add a without_interpreter_pins() context manager and apply it at every
boundary that builds or drives a rendered project: the render fixture's
copier.run_copy, run_in's subprocess env, and an autouse fixture for the
update-roundtrip module (its own copier runs plus `just ci`). A real
`copier copy` runs in no such environment, so this also makes the tests
faithful to it. Add a regression test that renders with a deliberately
incompatible UV_PYTHON and asserts the lock still succeeds.

Author: maybebyte

tests/conftest.py

@@ -2,9 +2,11 @@
 
 from __future__ import annotations
 
+import contextlib
+import os
 import shutil
 import subprocess
-from collections.abc import Callable, Mapping
+from collections.abc import Callable, Generator, Mapping
 from pathlib import Path
 from typing import TypeAlias
 
@@ -15,6 +17,29 @@
 
 RenderFn: TypeAlias = Callable[[Mapping[str, object], Path], Path]
 
+# Interpreter pins the maintainer harness must never leak into a rendered project.
+# `just test` runs under `uv run` (which exports VIRTUAL_ENV) and the CI matrix's
+# astral-sh/setup-uv exports UV_PYTHON=<matrix python>. Either, inherited by copier's
+# copy-time `uv lock`/`uv sync` _tasks, resolves the generated project against the
+# maintainer's interpreter instead of its own requires-python -- aborting every matrix
+# Python older than the rendered python_version (default 3.13). A real `copier copy` runs
+# in no such environment; strip them wherever the harness builds or drives a project.
+_INTERPRETER_PINS = ("UV_PYTHON", "VIRTUAL_ENV")
+
+
+@contextlib.contextmanager
+def without_interpreter_pins() -> Generator[None]:
+    """Run the body with the maintainer's interpreter pins absent from os.environ."""
+    saved = {name: os.environ.pop(name, None) for name in _INTERPRETER_PINS}
+    try:
+        yield
+    finally:
+        os.environ.update({name: value for name, value in saved.items() if value is not None})
+
+
+def _clean_env() -> dict[str, str]:
+    return {name: value for name, value in os.environ.items() if name not in _INTERPRETER_PINS}
+
 
 def _missing_tools() -> list[str]:
     return [t for t in REQUIRED_TOOLS if shutil.which(t) is None]
@@ -36,26 +61,32 @@ def _render(data: Mapping[str, object], dst: Path) -> Path:
         # Generation renders skip the slow pre-commit hook-install task (the config
         # does not exist until that layer is added). A dedicated test in Task 7
         # exercises the install path with the flag left at its default.
-        _ = copier.run_copy(
-            str(template_root),
-            str(dst),
-            data={"enable_precommit_install": False, **data},
-            defaults=True,
-            unsafe=True,
-            overwrite=True,
-            quiet=True,
-        )
+        # The copy-time `uv lock`/`uv sync` _tasks must resolve against the generated
+        # project's requires-python, not a leaked UV_PYTHON/VIRTUAL_ENV (see the pins note).
+        with without_interpreter_pins():
+            _ = copier.run_copy(
+                str(template_root),
+                str(dst),
+                data={"enable_precommit_install": False, **data},
+                defaults=True,
+                unsafe=True,
+                overwrite=True,
+                quiet=True,
+            )
         return dst
 
     return _render
 
 
 def run_in(project: Path, *args: str, check: bool = True) -> subprocess.CompletedProcess[str]:
     """Run a command inside a rendered project; capture output for assertions."""
+    # A rendered project's own tooling (`just ci`, `uv run ...`) must not inherit the
+    # maintainer's interpreter pins, or uv rebuilds its venv against the wrong Python.
     return subprocess.run(
         list(args),
         cwd=project,
         check=check,
         capture_output=True,
         text=True,
+        env=_clean_env(),
     )

tests/test_generation.py

@@ -114,6 +114,22 @@ def test_minimal_renders(render: RenderFn, tmp_path: Path) -> None:
     assert not (project / "{{ _copier_conf.answers_file }}.jinja").exists()
 
 
+def test_copy_tasks_ignore_a_leaked_interpreter_pin(
+    render: RenderFn, tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    """A leaked UV_PYTHON must not pin the rendered project's copy-time `uv lock`.
+
+    `just test` runs under `uv run` and the CI matrix's setup-uv exports UV_PYTHON=<matrix
+    python>; inherited by copier's `uv lock`/`uv sync` _tasks it resolves the generated
+    project against the maintainer's interpreter instead of its own requires-python, aborting
+    every matrix Python below the rendered python_version (default 3.13). The render fixture
+    strips it; prove a deliberately-leaked, incompatible pin no longer fails the render.
+    """
+    monkeypatch.setenv("UV_PYTHON", "3.11")  # older than MINIMAL's python_version (3.13)
+    project = render(MINIMAL, tmp_path / "out")
+    assert (project / "uv.lock").is_file()
+
+
 def test_readme_renders(render: RenderFn, tmp_path: Path) -> None:
     """README interpolates project_name/description; the Run block is gated on project_type."""
     app = render({**MINIMAL, "project_type": "application"}, tmp_path / "app")

tests/test_update_roundtrip.py

@@ -9,14 +9,23 @@
 import copier
 import pytest
 
+from tests.conftest import without_interpreter_pins
 from tests.test_generation import FULL, MINIMAL
 
 if TYPE_CHECKING:
+    from collections.abc import Iterator
     from pathlib import Path
 
 DATA = {**MINIMAL, "enable_precommit_install": False}
 
 
+@pytest.fixture(autouse=True)
+def isolate_interpreter() -> Iterator[None]:
+    """Keep UV_PYTHON/VIRTUAL_ENV out of this module's copier runs and rendered `just ci`."""
+    with without_interpreter_pins():
+        yield
+
+
 def _git(repo: Path, *args: str) -> None:
     # commit.gpgsign=false / tag.*sign=false: a global `commit.gpgsign=true` or
     # `tag.forceSignAnnotated=true` would otherwise make these commits/tags hang