test(e2e): enforce --system-update and isolate update-all integration tests

- Require --system-update for update-all integration tests
- Run tests with isolated HOME and temporary gitconfig
- Allow /src as git safe.directory for nix run
- Capture and print combined stdout/stderr on failure
- Ensure consistent environment for pkgmgr and nix-run executions

tests/e2e/test_update_all.py

@@ -8,13 +8,17 @@ This test is intended to be run inside the Docker container where:
   - and it is safe to perform real git operations.
 
 It passes if BOTH commands complete successfully (in separate tests):
-  1) pkgmgr update --all --clone-mode https --no-verification
+  1) pkgmgr update --all --clone-mode https --no-verification --system-update
-  2) nix run .#pkgmgr -- update --all --clone-mode https --no-verification
+  2) nix run .#pkgmgr -- update --all --clone-mode https --no-verification --system-update
 """
 
+from __future__ import annotations
+
 import os
 import subprocess
+import tempfile
 import unittest
+from pathlib import Path
 
 from test_install_pkgmgr_shallow import (
     nix_profile_list_debug,
@@ -23,69 +27,98 @@ from test_install_pkgmgr_shallow import (
 )
 
 
-class TestIntegrationUpdateAllHttps(unittest.TestCase):
+def _make_temp_gitconfig_with_safe_dirs(home: Path) -> Path:
-    def _run_cmd(self, cmd: list[str], label: str) -> None:
+    gitconfig = home / ".gitconfig"
-        """
+    gitconfig.write_text(
-        Run a real CLI command and raise a helpful assertion on failure.
+        "[safe]\n"
-        """
+        "\tdirectory = /src\n"
-        cmd_repr = " ".join(cmd)
+        "\tdirectory = /src/.git\n"
-        env = os.environ.copy()
+        "\tdirectory = *\n"
+    )
+    return gitconfig
 
-        try:
+
-            print(f"\n[TEST] Running ({label}): {cmd_repr}")
+class TestIntegrationUpdateAllHttps(unittest.TestCase):
-            subprocess.run(
+    def _common_env(self, home_dir: str) -> dict[str, str]:
-                cmd,
+        env = os.environ.copy()
-                check=True,
+        env["HOME"] = home_dir
-                cwd=os.getcwd(),
+
-                env=env,
+        home = Path(home_dir)
-                text=True,
+        home.mkdir(parents=True, exist_ok=True)
-            )
+
-        except subprocess.CalledProcessError as exc:
+        env["GIT_CONFIG_GLOBAL"] = str(_make_temp_gitconfig_with_safe_dirs(home))
+
+        # Ensure nix is discoverable if the container has it
+        env["PATH"] = "/nix/var/nix/profiles/default/bin:" + env.get("PATH", "")
+
+        return env
+
+    def _run_cmd(self, cmd: list[str], label: str, env: dict[str, str]) -> None:
+        cmd_repr = " ".join(cmd)
+        print(f"\n[TEST] Running ({label}): {cmd_repr}")
+
+        proc = subprocess.run(
+            cmd,
+            check=False,
+            cwd=os.getcwd(),
+            env=env,
+            text=True,
+            stdout=subprocess.PIPE,
+            stderr=subprocess.STDOUT,
+        )
+
+        print(proc.stdout.rstrip())
+
+        if proc.returncode != 0:
             print(f"\n[TEST] Command failed ({label})")
             print(f"[TEST] Command : {cmd_repr}")
-            print(f"[TEST] Exit code: {exc.returncode}")
+            print(f"[TEST] Exit code: {proc.returncode}")
 
             nix_profile_list_debug(f"ON FAILURE ({label})")
 
             raise AssertionError(
-                f"({label}) {cmd_repr!r} failed with exit code {exc.returncode}. "
+                f"({label}) {cmd_repr!r} failed with exit code {proc.returncode}.\n\n"
-                "Scroll up to see the full pkgmgr/nix output inside the container."
+                f"--- output ---\n{proc.stdout}\n"
-            ) from exc
+            )
 
     def _common_setup(self) -> None:
-        # Debug before cleanup
         nix_profile_list_debug("BEFORE CLEANUP")
-
-        # Cleanup: aggressively try to drop any pkgmgr/profile entries
-        # (keeps the environment comparable to other integration tests).
         remove_pkgmgr_from_nix_profile()
-
-        # Debug after cleanup
         nix_profile_list_debug("AFTER CLEANUP")
 
     def test_update_all_repositories_https_pkgmgr(self) -> None:
-        """
-        Run: pkgmgr update --all --clone-mode https --no-verification
-        """
         self._common_setup()
-
+        with tempfile.TemporaryDirectory(prefix="pkgmgr-updateall-") as tmp:
-        args = ["update", "--all", "--clone-mode", "https", "--no-verification"]
+            env = self._common_env(tmp)
-        self._run_cmd(["pkgmgr", *args], label="pkgmgr")
+            args = [
-
+                "update",
-        # After successful update: show `pkgmgr --help` via interactive bash
+                "--all",
-        pkgmgr_help_debug()
+                "--clone-mode",
+                "https",
+                "--no-verification",
+                "--system-update",
+            ]
+            self._run_cmd(["pkgmgr", *args], label="pkgmgr", env=env)
+            pkgmgr_help_debug()
 
     def test_update_all_repositories_https_nix_pkgmgr(self) -> None:
-        """
-        Run: nix run .#pkgmgr -- update --all --clone-mode https --no-verification
-        """
         self._common_setup()
-
+        with tempfile.TemporaryDirectory(prefix="pkgmgr-updateall-nix-") as tmp:
-        args = ["update", "--all", "--clone-mode", "https", "--no-verification"]
+            env = self._common_env(tmp)
-        self._run_cmd(["nix", "run", ".#pkgmgr", "--", *args], label="nix run .#pkgmgr")
+            args = [
-
+                "update",
-        # After successful update: show `pkgmgr --help` via interactive bash
+                "--all",
-        pkgmgr_help_debug()
+                "--clone-mode",
+                "https",
+                "--no-verification",
+                "--system-update",
+            ]
+            self._run_cmd(
+                ["nix", "run", ".#pkgmgr", "--", *args],
+                label="nix run .#pkgmgr",
+                env=env,
+            )
+            pkgmgr_help_debug()
 
 
 if __name__ == "__main__":