From e76a65927ed9945afefb3a50dcd7d145750627a3 Mon Sep 17 00:00:00 2001
From: Imani Manyara <imanimanyara@users.noreply.github.com>
Date: Mon, 19 Oct 2026 11:33:31 -0400
Subject: [PATCH] Guard the tests against literal credentials

Secret scanners cannot tell a test password from a leaked one, and
report both. GitGuardian raised 28 incidents across laranail by
2026-10-18, 27 of them test literals or false positives, each closed by
hand. This guard keeps the next one out: the suite now fails on any
literal credential under tests/, and on any TestCredentials purpose that
is not a single lowercase word, which scanners read as the password.

The guard is laranail/package-tools' shared AssertsNoLiteralCredentials,
so the floor rises to ^0.1.10, the first release with the purpose check.
---
 CHANGELOG.md                                  |  4 +++
 composer.json                                 |  2 +-
 .../Architecture/NoLiteralCredentialsTest.php | 27 +++++++++++++++++++
 3 files changed, 32 insertions(+), 1 deletion(-)
 create mode 100644 tests/Tools/Architecture/NoLiteralCredentialsTest.php

diff --git a/CHANGELOG.md b/CHANGELOG.md
index bb7f260..6ad5989 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Changed
+
+- A guard now keeps literal credentials out of the tests, and every credential the tests generate is named with a single-word purpose, so secret scanning has nothing to report. `laranail/package-tools` in `require-dev` is now `^0.1.10`, the first release with the purpose check.
+
 ## [0.1.7] - 2026-10-13
 
 ### Added
diff --git a/composer.json b/composer.json
index aef48c4..d7f0461 100644
--- a/composer.json
+++ b/composer.json
@@ -57,7 +57,7 @@
         "rector/rector": "^2.5.8",
         "roave/security-advisories": "dev-latest",
         "symfony/tui": "^8.2@dev",
-        "laranail/package-tools": "^0.1"
+        "laranail/package-tools": "^0.1.10"
     },
     "suggest": {
         "laranail/emojis": "The full Unicode emoji catalogue: Console::emoji() resolves every shortcode, not just its built-in map, and DisplayWidth measures ZWJ/flag/skin-tone sequences as two columns.",
diff --git a/tests/Tools/Architecture/NoLiteralCredentialsTest.php b/tests/Tools/Architecture/NoLiteralCredentialsTest.php
new file mode 100644
index 0000000..750c05a
--- /dev/null
+++ b/tests/Tools/Architecture/NoLiteralCredentialsTest.php
@@ -0,0 +1,27 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Simtabi\Laranail\Console\Tools\Tests\Architecture;
+
+use PHPUnit\Framework\TestCase;
+use Simtabi\Laranail\Package\Tools\Testing\AssertsNoLiteralCredentials;
+
+/**
+ * Secret scanning cannot tell a test password from a leaked one, and reports both. Tests take
+ * their credentials from TestCredentials at run time; this fails on any literal left behind.
+ */
+final class NoLiteralCredentialsTest extends TestCase
+{
+    use AssertsNoLiteralCredentials;
+
+    public function test_the_tests_hold_no_literal_credentials(): void
+    {
+        $this->assertNoLiteralCredentialsIn([dirname(__DIR__, 2)], minFiles: 82);
+    }
+
+    public function test_every_generated_credential_is_named_with_a_single_word(): void
+    {
+        $this->assertCredentialPurposesAreWordsIn([dirname(__DIR__, 2)], minFiles: 82);
+    }
+}