[imanimanyara]

Why

Secret scanners cannot tell a test password from a leaked one, and report both. GitGuardian raised 28 incidents across laranail by 2026-10-18, 27 of them test literals or false positives, each closed by hand. This guard keeps the next one out.

What changed

• tests/Arch/NoLiteralCredentialsTest.php (new) runs package-tools' AssertsNoLiteralCredentials with two tests:
  • assertNoLiteralCredentialsIn fails on any literal credential (named, strong or URL userinfo).
  • assertCredentialPurposesAreWordsIn fails on any TestCredentials purpose that is not a single lowercase word, since scanners read a compound one as the password itself.
• laranail/package-tools floor raised to ^0.1.10, the first release with the purpose check.
• CHANGELOG [Unreleased] → ### Changed entry.

Scope and floor

Scans tests/: 11 PHP files, floor minFiles: 10 (about 90%), so a wrong path fails instead of passing an empty scan. No literal credentials were found on main, so no test values changed. The file sits in tests/Arch, which the Architecture job in static-analysis.yml runs (pest --ci tests/Arch); the phpunit.xml suites cover only tests/Unit and tests/Feature.

Red proof

With the change committed, each test was shown to fail and then restored with git checkout HEAD -- <file> (nothing scratch committed):

1. A scratch line holding a literal under a credential name, built at run time → the literal test failed, the purpose test passed.
2. A scratch TestCredentials::password() call with a hyphenated purpose → the purpose test failed, the literal test passed.

Local gates

• Tests: Pest, 87 passed, 1 skipped (phpunit.xml suites); pest tests/Arch 12 passed
• laranail-pint --test: passed
• PHPStan (--debug --memory-limit=2G): no errors
• Rector (--dry-run --debug): no changes

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.