From 980aade3ca5d6f2299fa0f093cd28fe5f8947b0b Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Mon, 27 Jul 2026 06:57:25 +0000
Subject: [PATCH] test: add coverage for runtime Enabled(false) variant
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add two integration tests verifying that explicitly disabling a runtime
with `runtimes: python: false` and `runtimes: dotnet: false` suppresses
the corresponding pipeline steps (UsePythonVersion@0 / PipAuthenticate@1
and UseDotNet@2 / NuGetAuthenticate@1 respectively).

The `Enabled(false)` variant was previously untested; a logic inversion
in `is_enabled()` would have gone undetected.

(Note: a similar test for `node: false` was drafted but revealed an
existing production bug — UseNode@1 is still emitted when node is
explicitly disabled — and is excluded from this PR per workflow policy.)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 tests/compiler_tests.rs | 61 +++++++++++++++++++++++++++++++++++++++++
 1 file changed, 61 insertions(+)

diff --git a/tests/compiler_tests.rs b/tests/compiler_tests.rs
index 89872480..f8cb5f6d 100644
--- a/tests/compiler_tests.rs
+++ b/tests/compiler_tests.rs
@@ -8909,3 +8909,64 @@ fn test_smoke_failure_reporter_uses_registered_ado_names_and_staging_repo() {
         "front matter and prompt must agree on the staging issue repository"
     );
 }
+
+/// `runtimes: python: false` must emit no Python install or authenticate steps.
+///
+/// Guards against accidental `is_enabled()` logic inversion — if `Enabled(false)`
+/// were treated as enabled, `UsePythonVersion@0` and `PipAuthenticate@1` would
+/// appear in the compiled output.
+#[test]
+fn test_python_runtime_disabled_emits_no_python_steps() {
+    let compiled = compile_inline_agent(
+        "python-disabled",
+        r#"---
+name: "Python Disabled Agent"
+description: "Agent with python explicitly disabled"
+runtimes:
+  python: false
+safe-outputs:
+  noop: {}
+---
+
+## Python Disabled Agent
+"#,
+    );
+    assert!(
+        !compiled.contains("UsePythonVersion@0"),
+        "UsePythonVersion@0 must not appear when python: false\n{compiled}"
+    );
+    assert!(
+        !compiled.contains("PipAuthenticate@1"),
+        "PipAuthenticate@1 must not appear when python: false\n{compiled}"
+    );
+}
+
+/// `runtimes: dotnet: false` must emit no .NET install or authenticate steps.
+///
+/// Guards against accidental `is_enabled()` logic inversion — if `Enabled(false)`
+/// were treated as enabled, `UseDotNet@2` and `NuGetAuthenticate@1` would appear.
+#[test]
+fn test_dotnet_runtime_disabled_emits_no_dotnet_steps() {
+    let compiled = compile_inline_agent(
+        "dotnet-disabled",
+        r#"---
+name: "Dotnet Disabled Agent"
+description: "Agent with dotnet explicitly disabled"
+runtimes:
+  dotnet: false
+safe-outputs:
+  noop: {}
+---
+
+## Dotnet Disabled Agent
+"#,
+    );
+    assert!(
+        !compiled.contains("UseDotNet@2"),
+        "UseDotNet@2 must not appear when dotnet: false\n{compiled}"
+    );
+    assert!(
+        !compiled.contains("NuGetAuthenticate@1"),
+        "NuGetAuthenticate@1 must not appear when dotnet: false\n{compiled}"
+    );
+}