Skip tests that require network access with HERMETIC=true

[haydentherapper]

The config tests make outbound network calls since Load() calls
prepare() which fetches the OIDC configs. Tests that call Load() will
now be skipped. Tested with go test -tags=hermetic ./... without a
network connection.

Signed-off-by: Hayden Blauzvern hblauzvern@google.com

Summary

Ticket Link

Fixes #480

Release Note

In hermetic environments, tests that require network access can be skipped with -tags=hermetic

[haydentherapper]

cc @06kellyjac

[06kellyjac]

looking forward to this addition. Thanks :)

[nsmith5]

Two nits:

• I think hermetic tests should be the default and testing with additional requirements should be opt-in
• I prefer build tags here so that e.g go test ./... -tags=networking enables the tests that require networking.

[haydentherapper]

I'd prefer to continue running all tests by default. If we forget to enable the network tests for some reason, we'll lose some coverage. If we get more reports of tests run in hermetic environments, then we can consider switching, but since GitHub Actions runners have network access, I'm not too concerned.

//go:build !hermetic caused a build issue, pkg/config wasn't built so go test ./... failed - If I understand this correctly, the tests would need to be in their own build package with a negative statement.

[nsmith5]

You just need to move the non-hermetic tests to a seperate file like this: nsmith5@c4703f9

Can confirm that this diff works as expected (e.g go test runs all tests and go test -tags=hermetic only runs the hermetic ones)

[06kellyjac]

if default is hermetic and non-hermetic is opt in I think the tag should be nonhermetic or networked or something

[haydentherapper]

Yep, splitting it up resolved the issue. This switched it to go test -tags=hermetic ./... to skip tests that require network access. We'll leave the default to be running all tests.