Isolate database credentials for agent tests

tests/test_worker.py

@@ -35,3 +35,20 @@ def test_stop_signal_interrupts_worker_wait() -> None:
     worker._stop(15, None)
 
     assert worker.stop_event.is_set()
+
+
+def test_database_credentials_are_only_passed_to_test_process() -> None:
+    worker = AutomationWorker(settings())
+    workspace = Mock()
+    workspace.run.return_value = Mock(returncode=0, stdout="ok", stderr="")
+
+    results = worker._run_tests(workspace)
+
+    assert results[0]["returncode"] == 0
+    environment = workspace.run.call_args.kwargs["extra_environment"]
+    assert environment["AGENT_TEST_DB_ENABLED"] == "true"
+    assert environment["TEST_DB_USER"] == "test_runner"
+    assert environment["TEST_DB_PASSWORD"] == "test-secret"
+    assert environment["DB_DATABASE"] == "lai_agent_test"
+    assert environment["ERP_DATABASE"] == "customer_agent_test"
+    assert environment["COCKPIT_CONFIG_DATABASE"] == "cockpit_agent_test"