[Moep90]

Summary

The vault test helper now uses an external vault only when KAPITAN_TEST_VAULT_ADDR is set. Otherwise it starts its own container, even when VAULT_ADDR is exported. CI sets the new variable for its vault service container.

Fixes #1673

Motivation

VAULT_ADDR is the standard Vault client variable and often points at a real server. The helper used it as the test vault, so a developer with it exported got the test suite polling that server and trying to set it up with the dev root token root, or hanging forever on an unreachable address.

Affected files or URLs

• tests/vault_server.py: reads KAPITAN_TEST_VAULT_ADDR instead of VAULT_ADDR, and the "docker not installed" error names the new variable.
• .github/workflows/test-build-publish.yml: the test job sets KAPITAN_TEST_VAULT_ADDR instead of VAULT_ADDR. The tests that need VAULT_ADDR set it themselves, and the full suite passes locally without it in the environment.
• tests/test_vault.py: VaultServerAddressTest checks both paths with setup_container and setup_vault mocked, so nothing is contacted. The addresses are from 192.0.2.0/24 (TEST-NET-1).

Test plan

• Tests added: test_vault_addr_alone_is_not_used and test_kapitan_test_vault_addr_is_used. Both fail with master's tests/vault_server.py and pass with the change.
• Manual check with VAULT_ADDR=http://192.0.2.1:8200 exported: tests/test_vault.py and tests/test_vault_transit.py pass in about 12 s against their own container. With master's helper the same run hangs until I kill it.
• make lint passes
• make format passes (no formatting changes needed)
• Full test suite passes (uv run pytest tests/ --no-cov), run with VAULT_ADDR and VAULT_TOKEN unset and a throwaway HOME.

Risk assessment

Test helpers and CI only. Anyone who pointed the tests at their own test vault through VAULT_ADDR has to export KAPITAN_TEST_VAULT_ADDR instead. If the CI variable is wrong, the vault tests start their own container on the runner instead of using the service container.

This touches the same helper as #1559 and merges cleanly with it. #1559's test_unreachable_vault_addr_raises_instead_of_hanging now sets both VAULT_ADDR and KAPITAN_TEST_VAULT_ADDR, so it passes with or without this change, in either merge order.

I made this change with Claude Code.