From d50f8d3a8fbee8085099a6a5f46ad91ba080c021 Mon Sep 17 00:00:00 2001
From: Imani Manyara <imanimanyara@users.noreply.github.com>
Date: Mon, 19 Oct 2026 11:21:18 -0400
Subject: [PATCH] Guard the tests against literal credentials

Secret scanners cannot tell a test password from a leaked one, and
report both. GitGuardian raised 28 incidents across laranail by
2026-10-18, 27 of them test literals or false positives, each closed by
hand. This guard keeps the next one out: the suite fails on any literal
credential in the tests, and on any TestCredentials purpose that is not
a single plain word, which scanners read as the password itself.

Uses the shared AssertsNoLiteralCredentials trait, so package-tools'
floor rises to ^0.1.10, the first release with the purpose check.
---
 CHANGELOG.md                            |  4 ++++
 composer.json                           |  2 +-
 tests/Arch/NoLiteralCredentialsTest.php | 24 ++++++++++++++++++++++++
 3 files changed, 29 insertions(+), 1 deletion(-)
 create mode 100644 tests/Arch/NoLiteralCredentialsTest.php

diff --git a/CHANGELOG.md b/CHANGELOG.md
index ca6d4a0..90d98e4 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,6 +9,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Changed
 
+- **A guard now keeps literal credentials out of the tests**, and every generated credential's
+  purpose a single word. `NoLiteralCredentialsTest` runs package-tools' `AssertsNoLiteralCredentials`
+  over `tests/`, so secret scanning has nothing to report. Requires
+  `laranail/package-tools ^0.1.10`.
 - `laranail::pdf.install` now extends laranail/package-tools' `InstallCommand` and takes
   laranail/console's display API and run lifecycle from its `InteractsWithConsoleServices` and
   `InteractsWithConsoleWriter` traits instead of its `Command` base. Name, option, description,
diff --git a/composer.json b/composer.json
index 60b337d..1847c1d 100644
--- a/composer.json
+++ b/composer.json
@@ -40,7 +40,7 @@
         "illuminate/http": "^13.0",
         "illuminate/support": "^13.0",
         "laranail/console": "^0.1",
-        "laranail/package-tools": "^0.1",
+        "laranail/package-tools": "^0.1.10",
         "psr/http-message": "^1.1 || ^2.0",
         "psr/log": "^3.0"
     },
diff --git a/tests/Arch/NoLiteralCredentialsTest.php b/tests/Arch/NoLiteralCredentialsTest.php
new file mode 100644
index 0000000..fd955c9
--- /dev/null
+++ b/tests/Arch/NoLiteralCredentialsTest.php
@@ -0,0 +1,24 @@
+<?php
+
+declare(strict_types=1);
+
+use Simtabi\Laranail\Package\Tools\Testing\AssertsNoLiteralCredentials;
+
+/*
+ * Secret scanning cannot tell a test password from a leaked one, and reports both. Tests take
+ * their credentials from TestCredentials at run time; this fails on any literal left behind, and
+ * on any generated credential whose purpose is not a single plain word.
+ *
+ * Measured 2026-10-19: 11 PHP files under tests/.
+ */
+uses(AssertsNoLiteralCredentials::class);
+
+it('keeps literal credentials out of the tests', function (): void {
+    $this->assertNoLiteralCredentialsIn([dirname(__DIR__)], minFiles: 10);
+    expect(true)->toBeTrue();
+});
+
+it('names every generated credential with a single word', function (): void {
+    $this->assertCredentialPurposesAreWordsIn([dirname(__DIR__)], minFiles: 10);
+    expect(true)->toBeTrue();
+});