FreeIPA's test suite is using xfail to mark tests as known failures. A failing test doesn't cause the test suite to fail. Instead it's recored as XFAIL (expected failure). It's also possible that an xfail test passes, Pytest calls this XPASS (unexpected pass). PR-CI doesn't consider an unexpected pass as an error.

With @pytest.mark.xfail(strict=True), pytest turns an XPASS into an error. See https://pytest.readthedocs.io/en/reorganize-docs/new-docs/user/xfail.html for more details