test: force Turnstile test mode in CI

tests/test_turnstile.py

@@ -114,6 +114,21 @@ def test_turnstile_verification_returns_false_on_transport_error(monkeypatch) ->
     assert turnstile_module.verify_turnstile_token("token") is False
 
 
+def test_turnstile_settings_ignore_real_credentials_in_test_environment(monkeypatch) -> None:
+    from app.services import turnstile as turnstile_module
+
+    monkeypatch.setenv("APP_ENV", "test")
+    monkeypatch.setenv("TURNSTILE_SITE_KEY", "real-site-key")
+    monkeypatch.setenv("TURNSTILE_SECRET_KEY", "real-secret-key")
+
+    settings = turnstile_module.load_turnstile_settings()
+
+    assert settings.site_key == turnstile_module.DEFAULT_TURNSTILE_TEST_SITE_KEY
+    assert settings.secret_key == turnstile_module.DEFAULT_TURNSTILE_TEST_SECRET_KEY
+    assert settings.enabled is True
+    assert settings.uses_test_keys is True
+
+
 def test_turnstile_settings_support_always_fail_test_keys(monkeypatch) -> None:
     from app.services import turnstile as turnstile_module