Handle unreadable configuration files (#4035)

Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>

Author: SirHegel

docs/changelog/4031.bugfix.rst

@@ -0,0 +1,2 @@
+Report a handled configuration error instead of leaking a traceback when the selected configuration file exists but
+cannot be read - by :user:`SirHegel`.

src/tox/config/source/discover.py

@@ -50,7 +50,7 @@ def discover_source(config_file: Path | None, root_dir: Path | None) -> Source:
                 break
             except MissingRequiredConfigKeyError:
                 continue
-            except ValueError as exc:
+            except (ValueError, OSError) as exc:
                 msg = f"{src_type.__name__} failed loading {candidate.resolve()} due to {exc}"
                 raise HandledError(msg) from exc
         if src is None:
@@ -72,7 +72,7 @@ def _locate_source() -> Source | None:
                 except MissingRequiredConfigKeyError as exc:
                     msg = f"{src_type.__name__} skipped loading {candidate.resolve()} due to {exc}"
                     logging.info(msg)
-                except ValueError as exc:
+                except (ValueError, OSError) as exc:
                     msg = f"{src_type.__name__} failed loading {candidate.resolve()} due to {exc}"
                     raise HandledError(msg) from exc
     return None
@@ -89,7 +89,7 @@ def _load_exact_source(config_file: Path) -> Source:
             return src_type(config_file)
         except MissingRequiredConfigKeyError:  # ruff:ignore[try-except-in-loop]
             pass
-        except ValueError as exc:
+        except (ValueError, OSError) as exc:
             msg = f"{src_type.__name__} failed loading {config_file.resolve()} due to {exc}"
             raise HandledError(msg) from exc
     msg = f"could not recognize config file {config_file}"

tests/config/source/test_discover.py

@@ -1,13 +1,28 @@
 from __future__ import annotations
 
+import os
+import sys
 from typing import TYPE_CHECKING
 
+import pytest
+
+from tox.config.source.discover import discover_source
+from tox.report import HandledError
+
 if TYPE_CHECKING:
     from pathlib import Path
 
     from tox.pytest import ToxProjectCreator
 
 
+# Root ignores the permission bits, and Windows does not model them this way,
+# so the file stays readable and there is nothing to assert.
+unreadable_files_possible = pytest.mark.skipif(
+    sys.platform == "win32" or os.getuid() == 0,
+    reason="cannot make a file unreadable as root or on Windows",
+)
+
+
 def out_no_src(path: Path) -> str:
     return (
         f"ROOT: No loadable tox.ini or setup.cfg or pyproject.toml or tox.toml found, assuming empty tox.ini at {path}"
@@ -50,6 +65,30 @@ def test_bad_src_content(tox_project: ToxProjectCreator, tmp_path: Path) -> None
     assert outcome.out == f"ROOT: HandledError| config file {tmp_path / 'setup.cfg'} does not exist\n"
 
 
+@unreadable_files_possible
+@pytest.mark.parametrize("named", [True, False], ids=["explicit-path", "discovery"])
+def test_unreadable_config_raises_handled_error(tmp_path: Path, monkeypatch: pytest.MonkeyPatch, named: bool) -> None:
+    """Reading the file raises an OSError subclass, not ValueError.
+
+    Without handling it, discovery lets PermissionError escape and the CLI prints a traceback instead of the one-line
+    error used for malformed files.
+
+    This exercises discover_source directly: the tox_project fixture converts exceptions on its own, so it cannot tell
+    the two cases apart.
+
+    """
+    config = tmp_path / "tox.ini"
+    config.write_text("[tox]\nenv_list = py\n")
+    config.chmod(0o000)
+    monkeypatch.chdir(tmp_path)
+
+    try:
+        with pytest.raises(HandledError, match="failed loading"):
+            discover_source(config if named else None, None)
+    finally:
+        config.chmod(0o644)
+
+
 def test_malformed_config_does_not_prevent_help(tox_project: ToxProjectCreator) -> None:
     project = tox_project({"tox.toml": "deps =\n    mypy\n"})
     outcome = project.run("--help")