pytest 9 imports files it should not

[jku]

When pytest 9 is used action.py ends up importing files from the working directory. This can be problematic because when running in a workflow the working dir is client git root and may contain pytest files like conftest.py from the clients test suite.

Reproduction steps:

• make sure there is a branch of sigstore-conformance with pytest 9 (like dependabot/pip/pytest-9.0.1)
• create a branch of sigstore-python, modify the workflow so it uses sigstore-conformance pytest branch
• run the conformance workflow from the sigstore-python branch

This is what a test run looks like:

Run ./sigstore-conformance-env/bin/python /home/runner/work/_actions/sigstore/sigstore-conformance/main/action.py
ImportError while loading conftest '/home/runner/work/sigstore-python/sigstore-python/test/conftest.py'.
test/conftest.py:19: in <module>
    from id import (
E   ModuleNotFoundError: No module named 'id'
running sigstore-conformance against Sigstore production infrastructure

I suspect this is a pytest bug but have not filed anything yet -- the reproducer is very complicated currently

I plan to revert the pytest upgrade for now

[jku]

Based on the order of the output (and the fact that no amount code changes around pytest.main() do anything), the importerror likely happens already during import pytest: this should be verified though.

I can't reproduce this in a simpler project so I'm probably wrong here.

[jku]

A bit more testing:

• pytest.main() returns 4 and prints the import error
• I suspect two possible issues
  • pytest looks for configuration and test files in CWD
  • code in sigstore-conformance does "from test import ..." and this ends up importing a file from sigstore-python test suite because of CWD
• things I've tried so far, none of these worked:
  • added "--rootdir", str(_ACTION_PATH) to pytest args
  • added "--import-mode=importlib" to pytest args
  • added "-c", os.devnull to pytest args
  • changed working dir to a temp dir (outside of the current working dir) in the action, before calling action.py to prevent conformance from finding sigstore-python tests

🤷