test(api-core): move firmware upgrade coverage to integration suites

[poroh]

From huge host_bmc_firmware_test:
Move firmware upgrade completion state handling tests to machine controller integration tests.
Move status firmware upgrade status reporting API tests to api-core integration tests.

Related issues

#2001

Type of Change

• Add - New feature or capability
• Change - Changes in existing functionality
• Fix - Bug fixes
• Remove - Removed features or deprecated functionality
• Internal - Internal changes (refactoring, tests, docs, etc.)

Breaking Changes

• This PR contains breaking changes

Testing

• Unit tests added/updated
• Integration tests added/updated
• Manual testing performed
• No testing required (docs, internal refactor, etc.)

Additional Notes

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 5931d0fa-9d12-429d-b3da-8770daa0e3a4

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• ✅ Review completed - (🔄 Check again to review again)

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

🧹 Nitpick comments (1)

crates/api-core/tests/integration/scout_firmware_upgrade_status.rs (1)

200-233: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick win

Tighten the truncation boundary assertion.

assert!(result.stdout.len() <= 1500) only proves the output isn't too long — it would pass even if truncation were broken and returned an empty string. Since the handler's MAX_STORED_OUTPUT_SIZE is exactly 1500, assert on the exact boundary to actually exercise the truncation path.

🎯 Proposed fix for precise boundary assertions

-    assert!(result.stdout.len() <= 1500);
-    assert!(result.stderr.len() <= 1500);
-    assert!(result.error.len() <= 1500);
+    assert_eq!(result.stdout.len(), 1500);
+    assert_eq!(result.stderr.len(), 1500);
+    assert_eq!(result.error.len(), 1500);

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@crates/api-core/tests/integration/scout_firmware_upgrade_status.rs` around
lines 200 - 233, The truncation test in truncates_result_output is too weak
because it only checks an upper bound on result.stdout, result.stderr, and
result.error. Update the assertions to verify the stored output reaches the
exact truncation boundary used by the handler’s MAX_STORED_OUTPUT_SIZE instead
of allowing empty or shorter strings to pass. Use truncates_result_output and
the result fields from WaitingForScoutUpgrade to locate the test, and make the
assertions precise enough to exercise the truncation logic.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@crates/api-core/tests/integration/scout_firmware_upgrade_status.rs`:
- Around line 200-233: The truncation test in truncates_result_output is too
weak because it only checks an upper bound on result.stdout, result.stderr, and
result.error. Update the assertions to verify the stored output reaches the
exact truncation boundary used by the handler’s MAX_STORED_OUTPUT_SIZE instead
of allowing empty or shorter strings to pass. Use truncates_result_output and
the result fields from WaitingForScoutUpgrade to locate the test, and make the
assertions precise enough to exercise the truncation logic.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: f24395ed-4c69-4e85-a0ba-fd6c2787c36f

📥 Commits

Reviewing files that changed from the base of the PR and between 8dc207a and eebb855.

📒 Files selected for processing (5)

• crates/api-core/src/tests/host_bmc_firmware_test.rs
• crates/api-core/tests/integration/main.rs
• crates/api-core/tests/integration/scout_firmware_upgrade_status.rs
• crates/machine-controller/tests/integration/firmware_upgrade_completion.rs
• crates/machine-controller/tests/integration/main.rs

[github-actions]

🔍 Container Scan Summary

Service	Total	Critical	High	Medium	Low	Other
boot-artifacts-aarch64	3	0	0	3	0	0
boot-artifacts-x86_64	3	0	0	3	0	0
forge-admin-cli-x86_64	272	5	27	89	7	144
machine-validation-runner	769	25	209	278	36	221
machine_validation	769	25	209	278	36	221
machine_validation-aarch64	769	25	209	278	36	221
nvmetal-carbide	769	25	209	278	36	221
TOTAL	3354	105	863	1207	151	1028

Per-CVE detail lives in the per-service grype-* artifacts (JSON + SARIF). Severity counts only — no CVE IDs published here.