Repository navigation
Generate test credentials at run time - #28
Merged
Merged
Conversation
Secret scanning cannot tell a test key from a leaked one: GitGuardian raised 28 incidents across laranail, 27 of them test literals closed by hand. The push channel's API key is now generated per run, and a guard test fails on any literal left behind. The guard is a minimal local copy of package-tools' check rather than a dependency on it: package-tools requires PHP ^8.4.1, and this package's CI still tests 8.3, so even a require-dev entry would break that leg.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Secret scanning cannot tell a test key from a leaked one. GitGuardian raised 28 incidents across laranail by 2026-10-18, and 27 were test literals or false positives, each closed by hand. A value generated when the suite runs never reaches the repository, so there is nothing to report.
What changed
OutboundHttpChannelsTest's push-channelapi_keyis generated withbin2hex(random_bytes(16)), and the "key not leaked into the body" assertion checks for that same value.tests/Unit/NoLiteralCredentialsTest.php, scanningtests/with a floor of 8 of 10 files, plus a self-test that proves its scanner recognises a named literal and a URL password and ignores a variable.laranail/package-toolsdependency, deliberately. The sweep's shared helpers (TestCredentials,AssertsNoLiteralCredentials) ship in package-tools 0.1.9, which requires PHP^8.4.1. This package supports^8.3and its CI matrix tests 8.3, so even arequire-deventry would make the 8.3 leg unresolvable. Instead the literal is generated inline and the guard is a minimal local copy of package-tools' scanner (its named-position and URL rules, its shape and metadata-name filters, and the@credential-literal-exemptline marker).[Unreleased]→Changed.Verification
vendor/bin/pest: 83 passed.pint --test: pass. PHPStan (--debug --memory-limit=2G): no errors. Rector--dry-run --debug: clean.tests/, also reports 0 literals.'token' => 'hunter2-…'line appended toLocalChannelsTest.phpturned the guard red (LocalChannelsTest.php:116 hu…); restored withgit checkout.