env-isolation-pattern

Prevent pytest database wipes by enforcing environment isolation that unsets production-prefixed variables and overrides DB connection strings at import time. This ensures destructive integration tests only run against test-only databases and fail-fast if prod secrets leak.

Using os.environ.setdefault for environment isolation fails because it only sets missing variables and cannot override existing prod-like variables exported by parent shells. Replacing weak setdefault with explicit unsetting and unconditional overrides prevents alembic upgrades from inheriting prod connectivity.

Stop CI secret leaks by applying explicit unset/override isolation patterns before migration subprocesses execute. Force unconditional test-only DB and secret values at top-level conftest execution, preventing parent shell exports from passing production environment variables downstream.

Yes, environment isolation supports container-based isolation, local wrappers, CI/CD pipelines, and supervisor/export flows. It eliminates common leak paths by removing prod-like variables before subprocesses run, ensuring destructive tests and migrations fail to connect to production databases.

The best fail-fast leak validation checks for secret-prefix environment variables at top-level conftest execution before subprocesses run. Explicitly unset and override these variables to guarantee test runners and migration scripts abort immediately if production environment variables are detected.