docs: document that unit tests require TEST_SNYK_TOKEN

[rrama]

Pull Request Submission Checklist

• Follows CONTRIBUTING guidelines
• Commit messages are release-note ready
• Includes detailed description of changes
• Contains risk assessment (Low)
• Highlights breaking API changes (if applicable) — none
• Links to automated tests covering new functionality — n/a, docs only
• Includes manual testing instructions
• Updates relevant GitBook documentation — n/a, contributor docs
• Includes product update to be announced in the next stable release notes — n/a

What does this PR do?

Documents that npm run test:unit requires TEST_SNYK_TOKEN.

Without it, four suites fail with MissingApiTokenError, because they drive command entry points that call validateCredentials before doing anything else:

• test/jest/unit/lib/commands/fix/fix.spec.ts
• test/jest/unit/python/snyk-test-pyproject.spec.ts
• test/jest/unit/pnpm/snyk-test-pnpm-project.spec.ts
• test/jest/unit/snyk-code/snyk-code-test-report.spec.ts

This wasn't written down anywhere. CONTRIBUTING.md mentions TEST_SNYK_TOKEN only under acceptance tests, and AGENTS.md showed a bare npm run test:unit.

The part worth documenting explicitly is that reaching for SNYK_TOKEN — the obvious variable, and the one the CLI itself uses — has no effect. test/setup.js deletes SNYK_TOKEN and SNYK_API_KEY, then writes TEST_SNYK_TOKEN into the CLI user config. That's sensible (tests run against a known configuration rather than whatever the developer is authenticated as), but from the outside it looks like the token is being ignored and the tests are simply broken.

This came out of an agent reporting these suites as failures during environment setup, having concluded from the error that SNYK_TOKEN was needed. It isn't, and setting it changes nothing.

No behaviour is changed here — this only documents what already happens. Whether these suites should need a token is a separate question: CONTRIBUTING.md states unit tests "should not test services outside the code itself", so arguably they belong at the acceptance layer. Happy to raise that separately if the team agrees.

Where should the reviewer start?

CONTRIBUTING.md -> "Unit tests". The AGENTS.md change mirrors it.

How should this be manually tested?

npm run test:unit                            # 4 suites fail with MissingApiTokenError
TEST_SNYK_TOKEN=<token> npm run test:unit    # those 4 suites pass (22 tests)
SNYK_TOKEN=<token> npm run test:unit         # unchanged - still fails

What's the product update that needs to be communicated to CLI users?

None — contributor documentation only.

Risk assessment: Low

Documentation only.

Made with Cursor

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[github-actions]

	Warnings
⚠️	Since the CLI is unifying on a standard and improved tooling, we're starting to migrate old-style imports and exports to ES6 ones. A file you've modified is using either module.exports or require(). If you can, please update them to ES6 import syntax and export syntax. Files found: AGENTS.md

Generated by 🚫 dangerJS against e14c521