test(connectivity): isolate all checker env vars in TestDetectProxyConfig

[rrama]

Description

TestDetectProxyConfig cleared the environment before each subtest, but only the proxy variables:

proxyEnvVars := []string{"HTTPS_PROXY", "https_proxy", "HTTP_PROXY", "http_proxy", "NO_PROXY", "no_proxy"}

DetectProxyConfig iterates envVarSpecs, which also covers NODE_EXTRA_CA_CERTS, KRB5_CONFIG and KRB5CCNAME. Those three were never cleared, so the host machine's environment leaked into the result.

On any machine with NODE_EXTRA_CA_CERTS set — a corporate TLS-inspection CA bundle, for instance — six of the seven subtests fail:

Error: Not equal:
       expected: ""
       actual  : "/Users/…/zscaler-ca-bundle.pem"
Messages: NodeExtraCACerts mismatch

Unsetting the variable makes the same suite pass untouched, which is a confusing way to discover the test was never isolated. CI does not set these variables, which is why this has gone unnoticed.

The cleared list is now derived from envVarSpecs itself, so a variable added to the production spec is isolated automatically rather than quietly reintroducing this. It also removes the duplicated list of variable names.

Found while running the full suite to validate an unrelated change (#673).

Update after merging main: while this branch was open, main independently picked up the same isolation bug via an unrelated PR (#692) and fixed it too — with a hardcoded envVarsToClean list whose own comment flags it as needing manual sync with envVarSpecs. So the original failure this PR reported no longer reproduces on main. What this PR still adds: replacing that hardcoded, manually-synced list with the envVarSpecs-derived loop, so the sync-drift risk main's own comment calls out can't recur. Merged main in; the merge commit resolves the conflict between the two approaches by keeping this loop and main's newer "Node and Kerberos env vars set" test case.

Checklist

• Tests added and all succeed (make test) — connectivity_check_extension/... passes with NODE_EXTRA_CA_CERTS still set in my shell, which reproduced the failure before this change
• Regenerated mocks, etc. (make generate) — n/a
• Linted (make lint) — 0 issues
• Test your changes work for the CLI — n/a, test-only change; no shipped code or public API touched

Made with Cursor

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues
✅	Secrets	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[snyk-pr-review-bot]

PR Reviewer Guide 🔍

🧪 PR contains tests

🔒 No security concerns identified

⚡ No major issues detected

📚 Repository Context Analyzed This review considered 5 relevant code sections from 5 files (average relevance: 0.82) pkg/configtest/env.go (lines 1-33) pkg/local_workflows/connectivity_check_extension/connectivity/constants.go (lines 1-42) pkg/local_workflows/connectivity_check_extension/connectivity/types.go (lines 1-192) pkg/local_workflows/doctor_workflow/livecheck/connectivity/connectivity.go (lines 1-193) pkg/local_workflows/connectivity_check_extension/connectivity/checker.go (lines 1-255)

🤖 Repository instructions applied (from AGENTS.md)