test(codeql): keep current-time fixtures fresh

tests/test_audit_org_codeql_coverage.py

@@ -35,9 +35,11 @@ def default_setup_scanning_nothing(name: str) -> dict:
     }
 
 
-def covered_by_recent_analysis(name: str, *, days_ago: int = 1) -> dict:
+def covered_by_recent_analysis(
+    name: str, *, days_ago: int = 1, now: datetime = NOW
+) -> dict:
     """Return a repository payload covered by a recent, successful CodeQL analysis."""
-    created_at = (NOW - timedelta(days=days_ago)).isoformat().replace("+00:00", "Z")
+    created_at = (now - timedelta(days=days_ago)).isoformat().replace("+00:00", "Z")
     return {
         "name": name,
         "archived": False,
@@ -263,7 +265,11 @@ def test_null_latest_analysis_is_not_coverage() -> None:
 
 
 def test_audit_codeql_coverage_defaults_now_to_current_time() -> None:
-    repositories = [covered_by_recent_analysis("DefaultNowRepo", days_ago=0)]
+    repositories = [
+        covered_by_recent_analysis(
+            "DefaultNowRepo", days_ago=0, now=datetime.now(timezone.utc)
+        )
+    ]
 
     assert audit.audit_codeql_coverage(repositories) == []
 
@@ -302,7 +308,14 @@ def test_main_fail_path_reports_gaps_from_stdin(monkeypatch, capsys) -> None:
 def test_main_pass_path_reports_from_file_arg(tmp_path, capsys) -> None:
     payload_path = tmp_path / "repositories.json"
     payload_path.write_text(
-        json.dumps([covered_by_default_setup("ELUNVERA"), covered_by_recent_analysis("Orgmetra")]),
+        json.dumps(
+            [
+                covered_by_default_setup("ELUNVERA"),
+                covered_by_recent_analysis(
+                    "Orgmetra", now=datetime.now(timezone.utc)
+                ),
+            ]
+        ),
         encoding="utf-8",
     )