[quality] test: pin storeLiteLLMAPIKey PVC-failure fallback semantics (src/pkg/dashboard/litellm_key_store.go)

[kubestellar-hive]

Test Improvement

Adds src/pkg/dashboard/litellm_key_store_fallback_test.go, pinning the previously-untested failure branches of storeLiteLLMAPIKey / patchKeyIntoHiveSecrets (existing coverage only exercises the PVC-write happy path and not-in-cluster short-circuits):

• PVC write fails, Secret patch succeeds → save succeeds and api_key_file records the Secret mount path (config.DefaultLiteLLMAPIKeyFile), not the PVC path. Also pins the wire contract: PATCH to /api/v1/namespaces/<ns>/secrets/hive-secrets with the SA bearer token and base64 key.
• PVC write fails, not in cluster → save fails with the PVC error; empty path returned.
• Both stores fail → the PVC (primary store) error surfaces.
• Secrecy invariant: returned errors never contain the key value; a rejected patch yields a status-only error (API bodies can echo patch contents).

Tests are hermetic: fake in-cluster API via httptest.NewTLSServer + temp serviceaccount dir (token/namespace/ca.crt), PVC failure induced by a not-a-directory parent so it works at any uid.

Claimed ground

Files: src/pkg/dashboard/litellm_key_store.go (test-only PR; adds src/pkg/dashboard/litellm_key_store_fallback_test.go). Functions: storeLiteLLMAPIKey, patchKeyIntoHiveSecrets. Disjoint from open PRs #6348/#6343/#6292 (other dashboard files) and #6355 (pkg/hub).

Validation

go test -run 'TestStoreLiteLLMAPIKey|TestPatchKeyIntoHiveSecrets' ./pkg/dashboard/ — 4/4 pass.

---

Filed by quality agent (hold-gated mode). Human review required. Do not merge without removing hold (humans only).

— hive: agent=quality backend=copilot model=claude-fable-5

[github-actions]

Changelog: this PR changes code but carries no changelog entry
(no changelog.d/ fragment and no CHANGELOG.md edit).

If it is user-visible — a feature, a fix an operator would notice, a
security change, a migration, a deprecation, or anything breaking —
please add a fragment file changelog.d/<category>-<pr-or-slug>.md
containing exactly your entry (see changelog.d/README.md; the
category is one of added/changed/deprecated/fixed/security). Please
do not append to CHANGELOG.md's ## Unreleased directly — that
shared section is the merge-conflict generator fragments replaced
(#5675). If it is a refactor, a test-only change, or dependency
churn, no entry is needed and you can ignore this.

This is a reminder, not a gate; it never blocks a merge.

[clubanderson]

/approve

[kubestellar-prow]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: clubanderson

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [clubanderson]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[github-actions]

Thank you for your contribution! Your PR has been merged.

We'd love to hear how your experience was: share feedback