test(networking): remove live snyk.io call from Test_GetHTTPClient

[rrama]

Description

Test_GetHTTPClient made a real request to https://www.snyk.io and then asserted on the response with a non-fatal assert.Nil(t, err):

response, err := client.Get("https://www.snyk.io")
assert.Nil(t, err)                        // non-fatal: execution continues on error
assert.Equal(t, 200, response.StatusCode) // response is nil on error -> nil deref

When the request fails, response is nil and the next line dereferences it. That panics the entire pkg/networking test binary with invalid memory address or nil pointer dereference, aborting every remaining test in the package rather than failing this one test.

This reproduces deterministically anywhere www.snyk.io is unreachable — restricted CI sandboxes, offline development, or a captive network. It was found by an agent running the suite in a network-restricted environment.

Two problems, both fixed here:

1. Panic instead of a clean failure. require.NoError now stops the test at the point of failure, so a transport error fails this single test with a useful message and the rest of the package still runs.
2. A live external dependency in a unit test. The request now goes to an httptest server, matching the ten other HTTP tests in this same file, all of which already use httptest.NewServer.

TLS and CA-trust behaviour remain covered by Test_GetHTTPClient_EmptyCAs, which stands up its own TLS listener with a self-signed cert, so no coverage is lost. The test now needs no network and completes in 0.00s instead of ~0.4s.

Verified that the failure mode is fixed by temporarily pointing the client at a closed port: the test now reports FAIL ... connection refused with no panic, and the remaining tests in the binary still execute.

Bonus: Did some similar housekeeping for other tests in the file.

Checklist

• Tests added and all succeed (make test)
  • pkg/networking passes at 89.7% coverage. One unrelated pre-existing failure exists on my machine: TestDetectProxyConfig in connectivity_check_extension/connectivity inherits the ambient NODE_EXTRA_CA_CERTS instead of isolating it, and passes with that variable unset. Untouched by this PR.
• Regenerated mocks, etc. (make generate) — n/a, no mocks or API clients affected
• Linted (make lint) — 0 issues
• Test your changes work for the CLI — n/a, test-only change; no shipped code or public API is touched, so there is nothing for a consumer to pick up

Made with Cursor

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Secrets	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[rrama]

I acknowledge that in Go 1.27 we can move to httptest.NewTestServer(t, handler) and this cleanup will be handled automatically. (Along with the other advantages NewTestServer brings)
But we aren't there just yet.

[snyk-pr-review-bot]

PR Reviewer Guide 🔍

🧪 PR contains tests

🔒 No security concerns identified

⚡ No major issues detected

📚 Repository Context Analyzed This review considered 5 relevant code sections from 5 files (average relevance: 1.00) pkg/networking/networking.go (lines 1-215) pkg/mocks/networking.go (lines 1-213) pkg/local_workflows/connectivity_check_extension/connectivity/types.go (lines 1-192) pkg/local_workflows/connectivity_check_extension/connectivity/checker.go (lines 1-255) pkg/networking/middleware/netstack_error_handler.go (lines 1-170)

🤖 Repository instructions applied (from AGENTS.md)