Repository navigation
Generate test credentials at run time - #24
Merged
Merged
Conversation
Secret scanning cannot tell a test password from a leaked one: GitGuardian raised 28 incidents across laranail, 27 of them test literals closed by hand. The access-token tests now take their tokens from package-tools' TestCredentials, and a guard test fails on any literal left behind. The package-tools floor rises to ^0.1.9, the release that ships the helpers, so the prefer-lowest legs resolve them.
GitGuardian reads a compound purpose such as TestCredentials::password('smtp-new')
as the password itself, so a generated credential can be reported as a leaked one.
package-tools 0.1.10 adds assertCredentialPurposesAreWordsIn(), which fails on any
purpose that is not a single plain lowercase word; the guard test now runs it beside
the literal check, over the same directories and file floor.
Raise the package-tools floor to ^0.1.10 for it. That release's scanner also
recognises Eloquent cast names, provider names and reference keys as non-credentials,
so exemption markers it no longer needs are removed. Each was checked by confirming
CredentialLiterals::in() reports nothing on the line the marker covered.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Secret scanning cannot tell a test password from a leaked one. GitGuardian raised 28 incidents across laranail by 2026-10-18, and 27 were test literals or false positives, each closed by hand. A value generated when the suite runs never reaches the repository, so there is nothing to report.
What changed
laranail/package-toolsfloor raised from^0.1.3to^0.1.9, the release that shipsTestCredentialsandAssertsNoLiteralCredentials(laranail rule 3).AccessControlTestandConfigContractTesttake their tokens fromTestCredentials::secret(). The wrong token gets its own purpose, and the test asserts it differs from the configured one.tests/Unit/Architecture/NoLiteralCredentialsTest.php(undertests/Unitbecausephpunit.xmlonly defines the Unit and Feature suites), scanningtests/, floor 15 of 17 files.[Unreleased]→Changed.Verification
vendor/bin/pest: 76 passed, 1 skipped.laranail-pint --test: pass. PHPStan (--debug --memory-limit=2G): no errors. Rector: the repository has norector.php, onmainas on this branch.'token' => 'hunter2-…'line appended toAccessControlTest.phpturned the guard red (AccessControlTest.php:107 (named) hu…); restored withgit checkout.Follow-up: package-tools 0.1.10
One more commit,
Adopt package-tools 0.1.10's credential checks:laranail/package-toolsfloor raised to^0.1.10.assertCredentialPurposesAreWordsIn(), over the same directories and file floor: everyTestCredentialspurpose must be a single plain lowercase word, since secret scanning reads a compound purpose as the password itself.TestCredentials::password()call with a hyphenated purpose turned the new check red; the file was restored withgit checkoutand nothing of it is committed.[Unreleased]entry now names the new floor and the second check.