test(cmd): make step-summary warning test hermetic (#776)

TestRunWarnsOnUnwritableStepSummary was the only test in
cmd/threat-detect that reached the engine invocation without stubbing an
engine on PATH, so it executed whatever real `copilot` binary the host
provided. On a runner with working engine credentials (e.g. inside the
AWF sandbox during the standalone smoke workflows) this starts a live
agentic session that never returns, hanging the package until the 10
minute `go test` timeout and failing `make test`.

Stub a fake copilot for that test, and make runWithTestArgsCapture
default PATH to an empty directory when a test does not set one, so no
future test can silently fall through to a real engine CLI.

Co-authored-by: GitHub Ace <githubnext@users.noreply.github.com>
Co-authored-by: David Slater <12449447+davidslater@users.noreply.github.com>

Author: davidslater

cmd/threat-detect/logfile_test.go

@@ -440,13 +440,21 @@ func TestRunWarnsOnUnwritableStepSummary(t *testing.T) {
 	writeMinimalArtifacts(t, artifactsDir)
 	logPath := filepath.Join(t.TempDir(), "run.jsonl")
 	summaryPath := filepath.Join(t.TempDir(), "missing-dir", "summary.md")
+	// This test runs past the step-summary write into the engine invocation, so
+	// the engine must be stubbed. Without a fake copilot on PATH the run would
+	// execute whatever real `copilot` the host provides — which, on a runner
+	// with working engine credentials, starts a live agentic session and hangs
+	// until the package test timeout.
+	sinkJSON := `{"prompt_injection":false,"secret_leak":false,"malicious_patch":false,"reasons":[]}`
+	fakeBinDir := writeFakeCopilotWithSink(t, filepath.Join(t.TempDir(), "copilot-called"), sinkJSON, 0)
 
 	code, stderr := runWithTestArgsCapture(t, []string{
 		"threat-detect",
 		"-log-file", logPath,
 		artifactsDir,
 	}, map[string]string{
 		"GITHUB_STEP_SUMMARY": summaryPath,
+		"PATH":                fakeBinDir + string(os.PathListSeparator) + os.Getenv("PATH"),
 	})
 
 	if code == exitError && strings.Contains(stderr, "reason=config_error") {

cmd/threat-detect/main_test.go

@@ -426,6 +426,12 @@ func runWithTestArgsCapture(t *testing.T, args []string, env map[string]string)
 	for key, value := range env {
 		t.Setenv(key, value)
 	}
+	if _, ok := env["PATH"]; !ok {
+		// Keep the package hermetic: a test that reaches the engine without
+		// explicitly stubbing one must not fall through to a real engine CLI on
+		// the host PATH, which can block on network/auth until the test timeout.
+		t.Setenv("PATH", t.TempDir())
+	}
 
 	r, w, err := os.Pipe()
 	if err != nil {