cli: isolate the token store in tests so spawned binaries skip the keychain

[Soph]

https://entire.io/gh/entireio/cli/trails/594

Problem

Running go test ./cmd/entire/cli/ triggers a macOS keychain unlock prompt.

The cli package TestMain mocks the in-process zalando keyring (keyring.MockInit()), but several tests in this package spawn the real entire binary (or a git hook that invokes it). testing.Testing() is false in that child process, so neither the in-memory keyring mock nor the internal/testdirs fallback applies there — and the child's tokenstore default backend reaches the developer's real OS keychain.

Fix

Set ENTIRE_TOKEN_STORE=file (plus an isolated token / auth / config / cache path under a temp dir) process-wide in TestMain before m.Run, so spawned children inherit file-backed isolation. This mirrors what the integration and e2e TestMains already do. The in-process keyring.MockInit() stays for legacy auth.NewStore paths.

Verification

go test ./cmd/entire/cli/ passes with the external token env vars explicitly unset (env -u ENTIRE_TOKEN_STORE ...), relying solely on the TestMain change — and no keychain prompt. mise run lint: 0 issues.

🤖 Generated with Claude Code

---

Note

Low Risk
Test-only harness changes with no production code paths; aligns cli package TestMain with existing integration/e2e isolation patterns.

Overview
Fixes macOS keychain unlock prompts when running go test ./cmd/entire/cli/ by extending TestMain so child processes spawned by tests (real entire binary or git hooks) no longer hit the OS keychain.

In-process keyring.MockInit() only applies inside the test process; spawned children still used the default token store. TestMain now creates a temp isolation directory and sets ENTIRE_TOKEN_STORE=file plus paths for token store, auth store, config, and cache before m.Run(), matching integration and e2e harnesses. The temp dir is removed after tests finish. Plugin registration error handling is slightly refactored to avoid shadowing the new err from MkdirTemp.

^{Reviewed by Cursor Bugbot for commit 6a2ed44. Configure here.}

[Copilot]

Pull request overview

This PR updates the cmd/entire/cli package’s TestMain to ensure that tests spawning a real entire subprocess don’t fall back to the OS keychain, by enforcing a file-backed token store and isolating config/cache directories under a temp directory.

Changes:

• Configure ENTIRE_TOKEN_STORE=file (and related env vars/paths) process-wide in TestMain so spawned binaries inherit file-backed isolation.
• Add cleanup for the isolation temp directory after tests complete.
• Minor refactor to avoid reusing the err identifier for the go-git plugin registration call.