fix(e2e): inject shared credentials by identity

[yxzhaao]

Summary

Make shared live E2E credentials an identity-aware fallback for each RunCmd child process.

Root Cause

The live E2E job intentionally keeps tenant credentials in TEST_* variables so config and dry-run subprocesses do not activate the real environment credential provider. SkipWithoutTenantAccessToken previously promoted those values to standard LARKSUITE_CLI_* variables inside each test.

A newly added bot workflow omitted that helper. Its requests still declared DefaultAs: "bot", but the child process received no standard bot credentials and failed with config/not_configured.

Changes

• Inject shared TAT or UAT into child processes according to Request.DefaultAs.
• Treat shared credentials strictly as a fallback.
• Preserve explicit Request.Env values and existing standard credential environments, including dry-run fixtures.
• Keep requests without DefaultAs, such as config tests, isolated from shared credentials.
• Make SkipWithoutTenantAccessToken responsible only for local skip behavior.
• Add coverage for bot/user isolation, config isolation, dry-run fixture precedence, and request-level overrides.

Test Plan

• make -o fetch_meta quality-gate
• make fmt-check script-test (110 script tests)
• go test ./tests/cli_e2e -count=1
• go test ./tests/cli_e2e/... -run '^$' -count=1
• Run the config E2E package with shared TEST_* credentials present
• Run Base dry-run E2E tests with shared TEST_* credentials present

Summary by CodeRabbit

• Bug Fixes
  • Improved command execution credential handling for bot, user, and tenant access.
  • Preserved explicitly provided environment values instead of overwriting them with shared credentials.
  • Prevented temporary credential setup from modifying standard environment variables.
  • Ensured existing credential values are retained during dry runs and other command scenarios.

[coderabbitai]

📝 Walkthrough

Walkthrough

CLI end-to-end credential handling now preserves existing environment values, supports shared bot and user fallbacks, and avoids standard environment mutation during scoped tenant checks.

Changes

Credential environment handling

Layer / File(s)	Summary
Tenant credential environment isolation tests/cli_e2e/core.go, tests/cli_e2e/core_test.go	Scoped tenant checks no longer set standard CLI credential variables, and tests verify they remain unset.
Command credential fallback resolution tests/cli_e2e/core.go, tests/cli_e2e/core_test.go	buildCommandEnv conditionally injects identity-specific shared credentials, preserves dry-run credentials, and honors request-provided overrides through hasCredentialEnv.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

• larksuite/cli#541: Updates buildCommandEnv credential injection based on the requested identity.
• larksuite/cli#1904: Modifies shared end-to-end authentication environment handling.

Suggested labels: size/M, feature

Suggested reviewers: liangshuo-1

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title is concise and accurately summarizes the main change: identity-aware shared credential injection for E2E tests.
Description check	✅ Passed	The description matches the template well with Summary, Changes, and Test Plan, but it omits the Related Issues section.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@tests/cli_e2e/core_test.go`:
- Around line 302-334: Extend the credential-precedence tests around
buildCommandEnv with equivalent cases using DefaultAs: "user". Verify standard
dry-run user credentials are preserved, and request-provided user
credentials—including an explicitly empty access token—override shared
TEST_USER_ACCESS_TOKEN values. Directly assert the relevant user credential
fields and ensure shared user credentials are absent when overridden.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 38b002c7-c300-42d1-80f8-6f7642bc0ba8

📥 Commits

Reviewing files that changed from the base of the PR and between 483aade and 21c539e.

📒 Files selected for processing (2)

• tests/cli_e2e/core.go
• tests/cli_e2e/core_test.go

[github-actions]

🚀 PR Preview Install Guide

🧰 CLI update

npm i -g https://pkg.pr.new/larksuite/cli/@larksuite/cli@21c539e12db585b50440397825df00534a0807e7

🧩 Skill update

npx skills add yxzhaao/cli#fix/e2e-credential-fallback -y -g