ops.testing: revoking a previously-granted secret fails on 3.8.0 (worked on 3.7.1)

[sinanawad]

While evaluating the upgrade to ops 3.8.0, one of my charm unit tests started failing.
The test is a charm revoking a secret grant when a relation goes away.
The same test passes on ops 3.7.1 and fails on ops 3.8.0
(which pulls in ops-scenario 8.8.0 via the testing extra).

I've asked Claude to reduce it to the minimal self-contained reproduction below.

Let me know what you think.

This is the output I get AttributeError: 'frozenset' object has no attribute 'remove'

# repro_revoke.py
import ops
from ops import testing


class RevokeCharm(ops.CharmBase):
    def __init__(self, framework):
        super().__init__(framework)
        framework.observe(self.on["db"].relation_broken, self._on_broken)

    def _on_broken(self, event):
        # Revoke the secret's grant to the relation that is going away.
        secret = self.model.get_secret(label="my-secret")
        secret.revoke(event.relation)


def test_revoke_on_relation_broken():
    ctx = testing.Context(
        RevokeCharm,
        meta={"name": "revoke-charm", "provides": {"db": {"interface": "x"}}},
    )
    secret = testing.Secret(
        {"token": "s3cret"},
        owner="app",
        label="my-secret",
        remote_grants={1: {"remote-app"}},  # relation 1 was previously granted
    )

[tonyandrewmeyer]

This was also a problem in canonical/authentik-server-operator#25 but we didn't get a report, unfortunately.

[tonyandrewmeyer]

Type checking should have caught this, but there was a bug in our pyright paths, fixed in #2615

[tonyandrewmeyer]

This was also a problem in canonical/authentik-server-operator#25 but we didn't get a report, unfortunately.

The tests that would have surfaced this were added 2026-06-23, which is why my tests with hyrum didn't fail on them, all my tests were done before that, even the pre-release test I did on main would have had a slightly older clone.

However, looking over the corpus:

• valkey-operator, charmed-etcd-operator, jwt-integrator: use remote_grants=APP_NAME (a bare string). This is a bad test, but it would have started failing, so I need to check why that wasn't found.
• k8s-operator: has a revoke test but it's mock-based, not scenario, so it never touches mocking.py.
• authentik-worker-operator, microovn-operator: have relation_broken tests but nothing that revokes a Secret grant.
• smtp-integrator-operator, authentik-worker-operator libs: hook code calls secret.revoke() but no unit test exercises that path.

[tonyandrewmeyer]

• valkey-operator, charmed-etcd-operator, jwt-integrator: use remote_grants=APP_NAME (a bare string). This is a bad test, but it would have started failing, so I need to check why that wasn't found.

These use poetry and explicitly ops-scenario rather than ops[testing], which hit a bug in hyrum that only ops would be bumped (exacerbated by ops 3.7.1 having missed the .dev0 version bump that would normally prevent matching the published packages). I'll fix in canonical/hyrum#73.