test: keep webui CI hermetic offline

tests/test_webui_ci_gate.py

@@ -4,10 +4,14 @@ import subprocess
 import sys
 import unittest
 from pathlib import Path
+from unittest import mock
 
 sys.path.insert(0, str(Path(__file__).resolve().parent.parent))
 
 from webui.ci_paths import should_run_webui_ci, touches_webui_surface
+from webui.lease_loader import load_lease_snapshot
+from webui.queue_loader import load_queue_snapshot
+from webui.runtime_health import load_runtime_snapshot
 
 _REPO_ROOT = Path(__file__).resolve().parent.parent
 
@@ -50,5 +54,37 @@ class TestCiRunnerScript(unittest.TestCase):
         self.assertEqual(result.returncode, 0, result.stderr or result.stdout)
 
 
+class TestOfflineWebuiCiMode(unittest.TestCase):
+    def test_offline_mode_avoids_live_queue_auth(self):
+        with mock.patch.dict(os.environ, {"WEBUI_TEST_OFFLINE": "1"}):
+            with mock.patch(
+                "webui.queue_loader.get_auth_header",
+                side_effect=AssertionError("live auth should not run"),
+            ):
+                snapshot = load_queue_snapshot()
+        self.assertIsNone(snapshot.fetch_error)
+        self.assertEqual(snapshot.prs, ())
+        self.assertEqual(snapshot.issues, ())
+
+    def test_offline_mode_avoids_live_lease_auth(self):
+        with mock.patch.dict(os.environ, {"WEBUI_TEST_OFFLINE": "1"}):
+            with mock.patch(
+                "webui.lease_loader.get_auth_header",
+                side_effect=AssertionError("live auth should not run"),
+            ):
+                snapshot = load_lease_snapshot()
+        self.assertIsNone(snapshot.fetch_error)
+        self.assertEqual(snapshot.reviewer_leases, ())
+
+    def test_offline_mode_avoids_live_runtime_identity(self):
+        with mock.patch.dict(os.environ, {"WEBUI_TEST_OFFLINE": "1"}):
+            with mock.patch(
+                "webui.runtime_health.get_auth_header",
+                side_effect=AssertionError("live auth should not run"),
+            ):
+                snapshot = load_runtime_snapshot()
+        self.assertEqual(snapshot.identity_error, "offline web UI test mode")
+
+
 if __name__ == "__main__":
-    unittest.main()
+    unittest.main()

tests/test_webui_queue_dashboard.py

@@ -206,8 +206,9 @@ class TestQueueRoutes(unittest.TestCase):
         self.assertEqual(data["pagination"]["issues"]["returned_count"], 3)
 
     def test_queue_fail_closed_without_credentials(self):
-        with mock.patch("webui.queue_loader.get_auth_header", return_value=None):
-            snapshot = load_queue_snapshot()
+        with mock.patch.dict("os.environ", {"WEBUI_TEST_OFFLINE": "0"}):
+            with mock.patch("webui.queue_loader.get_auth_header", return_value=None):
+                snapshot = load_queue_snapshot()
         self.assertIsNotNone(snapshot.fetch_error)
         self.assertEqual(len(snapshot.prs), 0)
 
@@ -285,4 +286,4 @@ class TestQueueFailClosedUx(unittest.TestCase):
 
 
 if __name__ == "__main__":
-    unittest.main()
+    unittest.main()