Integration test for daemon environment scrubbing

This shows that pantsbuild#5898 works, which itself fixed pantsbuild#5854

tests/python/pants_test/pantsd/test_pantsd_integration.py

@@ -95,16 +95,16 @@ def pantsd_test_context(self, log_level='info', extra_config=None, expected_runs
         pid_dir = os.path.join(workdir_base, '.pids')
         workdir = os.path.join(workdir_base, '.workdir.pants.d')
         print('\npantsd log is {}/pantsd/pantsd.log'.format(workdir))
-        pantsd_config = {
-          'GLOBAL': combined_dict({
+        pantsd_config = combined_dict({
+          'GLOBAL': {
             'enable_pantsd': True,
             # The absolute paths in CI can exceed the UNIX socket path limitation
             # (>104-108 characters), so we override that here with a shorter path.
             'watchman_socket_path': '/tmp/watchman.{}.sock'.format(os.getpid()),
             'level': log_level,
             'pants_subprocessdir': pid_dir
-          }, extra_config or {})
-        }
+          }
+        }, extra_config or {})
         checker = PantsDaemonMonitor(pid_dir)
         self.assert_success_runner(workdir, pantsd_config, ['kill-pantsd'])
         try:
@@ -123,13 +123,14 @@ def pantsd_test_context(self, log_level='info', extra_config=None, expected_runs
           checker.assert_stopped()
 
   @contextmanager
-  def pantsd_successful_run_context(self, log_level='info', extra_config=None):
+  def pantsd_successful_run_context(self, log_level='info', extra_config=None, extra_env=None):
     with self.pantsd_test_context(log_level, extra_config) as (workdir, pantsd_config, checker):
       yield (
         functools.partial(
           self.assert_success_runner,
           workdir,
-          pantsd_config
+          pantsd_config,
+          extra_env=extra_env,
         ),
         checker,
         workdir,
@@ -143,16 +144,17 @@ def _run_count(self, workdir):
     else:
       return 0
 
-  def assert_success_runner(self, workdir, config, cmd, extra_config={}, expected_runs=1):
+  def assert_success_runner(self, workdir, config, cmd, extra_config={}, extra_env={}, expected_runs=1):
     combined_config = combined_dict(config, extra_config)
-    print(bold(cyan('\nrunning: ./pants {} (config={})'
-                    .format(' '.join(cmd), combined_config))))
+    print(bold(cyan('\nrunning: ./pants {} (config={}) (extra_env={})'
+                    .format(' '.join(cmd), combined_config, extra_env))))
     run_count = self._run_count(workdir)
     start_time = time.time()
     run = self.run_pants_with_workdir(
       cmd,
       workdir,
       combined_config,
+      extra_env=extra_env,
       # TODO: With this uncommented, `test_pantsd_run` fails.
       # tee_output=True
     )
@@ -399,7 +401,7 @@ def test_pantsd_launch_env_var_is_not_inherited_by_pantsd_runner_children(self):
 
   def test_pantsd_invalidation_file_tracking(self):
     test_file = 'testprojects/src/python/print_env/main.py'
-    config = {'pantsd_invalidation_globs': '["testprojects/src/python/print_env/*"]'}
+    config = {'GLOBAL': {'pantsd_invalidation_globs': '["testprojects/src/python/print_env/*"]'}}
     with self.pantsd_successful_run_context(extra_config=config) as (
       pantsd_run, checker, workdir, _
     ):
@@ -519,3 +521,16 @@ def test_pantsd_multiple_parallel_runs(self):
       waiter_result = PantsResult(waiter_pants_command, waiter_pants_process.returncode, waiter_stdout_data.decode("utf-8"),
         waiter_stderr_data.decode("utf-8"), workdir)
       self.assert_success(waiter_result)
+
+  def test_pantsd_environment_scrubbing(self):
+    # This pair of JVM options causes the JVM to always crash, so the command will fail if the env
+    # isn't stripped.
+    with self.pantsd_successful_run_context(
+      extra_config={'compile.zinc': {'jvm_options': '-Xmx1g'}},
+      extra_env={'_JAVA_OPTIONS': '-Xms2g'},
+    ) as (pantsd_run, checker, workdir):
+      pantsd_run(['help'])
+      checker.assert_started()
+
+      result = pantsd_run(['compile', 'examples/src/java/org/pantsbuild/example/hello/simple'])
+      self.assert_success(result)