fix(deploy): keep secret dry-runs compatible with annotation policy

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a1468b-63fa-7710-85dc-8f2e16b3ebfa

tests/test_server_dryrun_commands.py

@@ -0,0 +1,30 @@
+"""Pure Make command fixture: run with --noconftest, no database or cluster."""
+import json
+import os
+from pathlib import Path
+import subprocess
+import sys
+import pytest
+
+@pytest.mark.parametrize('namespace_exists',[True,False])
+def test_secret_server_dryrun_uses_ssa_without_force_or_other_phase_changes(tmp_path,namespace_exists):
+    makefile=Path(__file__).resolve().parents[1]/'Makefile'
+    log=tmp_path/'commands.jsonl';helm=tmp_path/'helm';kubectl=tmp_path/'kubectl'
+    helm.write_text('#!'+sys.executable+'\nprint("apiVersion: v1\\nkind: ConfigMap\\nmetadata: {name: fixture}")\n')
+    kubectl.write_text('#!'+sys.executable+'\nimport json,os,sys\nwith open(os.environ["NK_DRYRUN_LOG"],"a") as log:log.write(json.dumps(sys.argv[1:])+"\\n")\nif sys.argv[1:3]==["get","namespace"] and os.environ["NK_NAMESPACE_EXISTS"]=="0":raise SystemExit(1)\n')
+    helm.chmod(0o700);kubectl.chmod(0o700)
+    env=dict(os.environ);env['NK_DRYRUN_LOG']=str(log);env['NK_NAMESPACE_EXISTS']='1' if namespace_exists else '0'
+    p=subprocess.run(['make','--no-print-directory','-f',str(makefile),'railiance-state-hub-server-dry-run','HELM='+str(helm),'KUBECTL='+str(kubectl),'RAILIANCE_STATE_HUB_IMAGE_TAG=main-51bc70d'],cwd=tmp_path,env=env,capture_output=True,timeout=10)
+    assert p.returncode==0
+    calls=[json.loads(line) for line in log.read_text().splitlines()]
+    applies=[args for args in calls if args[0]=='apply']
+    secrets=[args for args in applies if any(p.endswith('.sops.yaml.template') for p in args)]
+    assert len(secrets)==2
+    assert all('--force-conflicts' not in args and '--force' not in args for args in applies)
+    for args in secrets:
+        if '--dry-run=server' in args:assert '--server-side' in args
+        else:assert not namespace_exists and '--dry-run=client' in args and '--server-side' not in args
+    others=[args for args in applies if args not in secrets]
+    assert all('--server-side' not in args for args in others)
+    assert all('--dry-run=server' in args or '--dry-run=client' in args for args in applies)
+    assert not any(args[0] in {'create','replace','delete','patch'} for args in calls)