Fix CI: skip GUI theme test without qt_material, clear Sonar/Codacy new-code findings

- test_r3_gui_main_window: importorskip qt_material so the headless job
  (PySide6 but no theme extra) skips instead of erroring collection.
- Clear Sonar new-code BUG/VULNERABILITY findings on the round-3 tests:
  slice access over index, pytest.approx for exact floats, dummy host
  URLs to https, and justified NOSONAR on reflexivity/side-effect asserts
  and the loopback-test TLS context.
- nosemgrep the two Codacy false positives (subprocess.TimeoutExpired is
  an exception class, not a subprocess call).

Author: JE-Chen

test/unit_test/headless/test_platform_backend_binding.py

@@ -161,7 +161,7 @@ def test_scroll_clamps_and_fills_a_partial_coordinate(monkeypatch):
 
     auto_control_mouse.mouse_scroll(5, x=99999)
 
-    assert events[0] == ("move", 1919, 7)
+    assert events[:1] == [("move", 1919, 7)]
 
 
 def test_missing_coords_still_fall_back_to_the_cursor(monkeypatch):

test/unit_test/headless/test_r3_agent_computer_use.py

@@ -85,11 +85,11 @@ def test_left_mouse_down_passes_coordinate_when_present():
 # --- finding 1c: an explicit 0 must be honoured ------------------------
 
 def test_wait_honours_explicit_zero_duration():
-    assert _action_wait({"duration": 0})["input"]["seconds"] == 0.0
+    assert _action_wait({"duration": 0})["input"]["seconds"] == pytest.approx(0.0)
 
 
 def test_wait_defaults_when_duration_absent():
-    assert _action_wait({})["input"]["seconds"] == 1.0
+    assert _action_wait({})["input"]["seconds"] == pytest.approx(1.0)
 
 
 def test_scroll_honours_explicit_zero_amount():

test/unit_test/headless/test_r3_executor_containment.py

@@ -61,7 +61,7 @@ def test_empty_loop_body_is_noop():
 def test_shell_to_var_timeout_is_contained(monkeypatch):
     """A shell timeout is converted to a contained framework error."""
     def _timeout(*_args, **kwargs):
-        raise subprocess.TimeoutExpired(cmd="x", timeout=kwargs.get("timeout", 1))
+        raise subprocess.TimeoutExpired(cmd="x", timeout=kwargs.get("timeout", 1))  # nosemgrep: python.lang.security.audit.dangerous-subprocess-use-audit.dangerous-subprocess-use-audit  # reason: raising the TimeoutExpired exception class, not spawning a subprocess
 
     monkeypatch.setattr(subprocess, "run", _timeout)
     engine = Executor()

test/unit_test/headless/test_r3_gui_main_window.py

@@ -11,6 +11,10 @@
 
 os.environ.setdefault("QT_QPA_PLATFORM", "offscreen")
 pytest.importorskip("PySide6.QtWidgets")
+# main_window imports qt_material (the theme); the headless CI job installs
+# PySide6 but not the GUI theme extra, so skip cleanly there rather than erroring
+# out collection for the whole suite.
+pytest.importorskip("qt_material")
 
 from PySide6.QtWidgets import QApplication, QMainWindow  # noqa: E402
 

test/unit_test/headless/test_r3_gui_script_builder.py

@@ -49,7 +49,7 @@ def _command_with_body_key():
 def test_step_uses_identity_equality():
     a = Step(command="AC_ok")
     b = Step(command="AC_ok")  # structurally identical, distinct object
-    assert a == a
+    assert a == a  # NOSONAR python:S1764  # reason: verifies identity-equality reflexivity (a is a)
     assert a != b
     steps = [a, b]
     steps.remove(b)

test/unit_test/headless/test_r3_mcp_http_timeout.py

@@ -61,7 +61,7 @@ def _server_ssl_context(tmp_path: Path) -> ssl.SSLContext:
         format=serialization.PrivateFormat.TraditionalOpenSSL,
         encryption_algorithm=serialization.NoEncryption(),
     ))
-    ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
+    ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)  # NOSONAR python:S4423  # reason: loopback test server; PROTOCOL_TLS_SERVER negotiates modern TLS
     ctx.load_cert_chain(certfile=str(cert_path), keyfile=str(key_path))
     return ctx
 

test/unit_test/headless/test_r3_mcp_tool_error_containment.py

@@ -40,7 +40,7 @@ def _call(server: MCPServer, name: str) -> Dict[str, Any]:
 
 @pytest.mark.parametrize("exc", [
     ImageNotFoundException("not on screen"),
-    subprocess.TimeoutExpired(cmd="sleep", timeout=1.0),
+    subprocess.TimeoutExpired(cmd="sleep", timeout=1.0),  # nosemgrep: python.lang.security.audit.dangerous-subprocess-use-audit.dangerous-subprocess-use-audit  # reason: exception instance for parametrize, not a subprocess call
     sqlite3.OperationalError("no such table"),
 ])
 def test_framework_and_external_errors_become_iserror_result(exc):

test/unit_test/headless/test_r3_net_admin_client.py

@@ -27,7 +27,7 @@ def spy(payload):
         return original(payload)
 
     client._write_atomic = spy
-    client.add_host("x", "http://x", "tok")
+    client.add_host("x", "https://x", "tok")
 
     assert observed["held"] is True
 
@@ -36,14 +36,14 @@ def test_write_is_atomic_and_cleans_up_on_failure(tmp_path, monkeypatch):
     """A failed replace must leave the prior file intact and drop the temp."""
     path = tmp_path / "hosts.json"
     client = AdminConsoleClient(persist_path=path)
-    client.add_host("keep", "http://k", "tok-keep")
+    client.add_host("keep", "https://k", "tok-keep")
     good = path.read_text(encoding="utf-8")
 
     def boom_replace(_src, _dst):
         raise OSError("disk full")
 
     monkeypatch.setattr(os, "replace", boom_replace)
-    client.add_host("second", "http://s", "tok-2")  # save fails atomically
+    client.add_host("second", "https://s", "tok-2")  # save fails atomically
 
     assert path.read_text(encoding="utf-8") == good  # not truncated
     data = json.loads(path.read_text(encoding="utf-8"))
@@ -59,7 +59,7 @@ def test_concurrent_add_host_does_not_lose_hosts(tmp_path):
     client = AdminConsoleClient(persist_path=path)
 
     def add(index: int) -> None:
-        client.add_host(f"host{index}", f"http://h{index}", f"tok{index}")
+        client.add_host(f"host{index}", f"https://h{index}", f"tok{index}")
 
     threads = [threading.Thread(target=add, args=(i,)) for i in range(20)]
     for thread in threads:

test/unit_test/headless/test_r3_net_triggers.py

@@ -100,7 +100,7 @@ def test_decode_header_unknown_charset_does_not_raise():
     # Prove the input genuinely triggers the LookupError path the old
     # `except ValueError` could not catch.
     with pytest.raises(LookupError):
-        str(make_header(decode_header(poisoned)))
+        str(make_header(decode_header(poisoned)))  # NOSONAR python:S2201  # reason: called for its raising side effect (proves the LookupError path)
     # The helper must swallow it and fall back to the raw value.
     assert et._decode_header_value(poisoned) == poisoned