[tests-only][full-ci]test(cli): add clean-orphaned-grants CLI test scenarios

[anon-pradip]

Description

Add acceptance tests for ocis shares clean-orphaned-grants CLI command.

Changes

New feature file

tests/acceptance/features/cliCommands/cleanOrphanedGrants.feature with 4 scenarios:

• Run in non-dry-run mode
• Run with space-id filter
• Run with force flag
• Run on a space with shares (no orphans expected)

New step definitions in CliContext.php

• Given the administrator has configured service account credentials
• When the administrator runs clean-orphaned-grants in non-dry-run mode
• When the administrator runs clean-orphaned-grants for space :spaceName owned by :user
• When the administrator runs clean-orphaned-grants with force flag

Related Issue

• Fixes [QA] Add CLI test to clean orphaned grants #11989

Motivation and Context

How Has This Been Tested?

• test environment:
• locally
• ci

Screenshots (if appropriate):

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Technical debt
• Tests only (no source changes)

Checklist:

• Code changes
• Unit tests added
• Acceptance tests added
• Documentation ticket raised:

[update-docs]

Thanks for opening this pull request! The maintainers of this repository would appreciate it if you would create a changelog item based on your changes.

[kw-security]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[DeepDiver1975]

Reviewed as tests-only — looks good overall. The 4 scenarios build real ocis shares clean-orphaned-grants invocations (correct --service-account-id/secret, --space-id, --force, --dry-run=false flags) through CliHelper::runCommand, and every asserted output substring maps to an actual print statement in ocis/pkg/command/shares.go (pre-flight mode/scope/force lines, == Primary scan ==, Summary:, Orphans:/Reverse orphans: counts). The flag-specific assertions (scope: limiting scan to space, 1 target space(s), flags: --force active) keep the scenarios genuinely distinct and exercise different branches. No hard sleeps, no cross-scenario ordering deps, and the assertion steps (the command output should contain, the command should be successful) are the existing harness steps that decode the JSON response and assert on real stdout — not no-ops. CI is fully green, including the cliCommands acceptance job.

One observation (non-blocking): all scenarios assert Orphans: 0 candidate(s) / Reverse orphans: 0 candidate(s) and none set up a genuinely orphaned grant, so the count is effectively pinned at 0 in every path (incl. the "space with shares" case, where a legitimately-shared file correctly yields a non-orphan grant). These tests confirm the command runs, accepts its flags, scopes correctly, and reports cleanly on a healthy system, but they do not exercise the detection/removal path (count going N→0). A follow-up that orphans a grant and asserts it gets cleaned would strengthen coverage — but that requires corrupting share-manager state, so the current scope is reasonable for acceptance tests.

mergeable=MERGEABLE; the BLOCKED merge state is just the required-review gate.

🤖 Generated with Claude Code