Repository navigation
Generate test credentials at run time - #37
Merged
Merged
Conversation
GitGuardian raised 28 incidents across laranail by 2026-10-18, 27 of them literal test credentials or false positives, each closed by hand. Passwords and secrets the suite only needed as arbitrary values are now generated by TestCredentials, one plain-word purpose per value. The confirmation tests assert their matching and mismatching values differ, since the failing case depends on it. A guard fails on any literal added later. Rule tests whose input is the point (too short for a min(), missing exactly one character class, digits only) keep their literal and carry an exemption marker with the reason. package-tools 0.1.9 is the first release with TestCredentials and the guard, so the floor moves to ^0.1.9.
Benchmark results
|
GitGuardian reads a compound purpose, two words joined by a hyphen, as the password itself, which turns a generated credential back into a reported one. package-tools 0.1.10 ships assertCredentialPurposesAreWordsIn(), so the floor moves to ^0.1.10 and the credential guard gains a second test that keeps every purpose a single plain lowercase word. No purpose in this suite needed renaming, and every remaining exemption marker is still required by the 0.1.10 scanner.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
GitGuardian raised 28 incidents across laranail by 2026-10-18. 27 were literal test credentials or false positives, and each was closed by hand. This is the org-wide sweep that stops the next one.
What changed
CredentialLiterals→ 0: 55 replaced, 26 exempted (25 markers).TestCredentials::password()/::secret()wherever the exact value does not matter: passwords that must merely satisfy a rule, confirmation pairs,hunter2/hunter3-style match and mismatch values, unknown-field values in thedropUnknownFieldstests, a closure-bypass value, a non-UUID value, and the userinfo in the URL credential tests (built withsprintf). Where a test needs a length, the generator is asked for it (password('brief', 8),password('plain', 14),password('excessive', 41),password('balanced', 12)). Purposes are single plain words.PasswordRuleTest,StringRuleTestand the wildcardRuleSetTestassertmismatchdiffers fromconfirmed.// @credential-literal-exempt: <reason>), because the literal is what the test proves:PasswordRuleTest(16): a deliberately weak input; exactly the 8-character minimum; shorter than the minimum (×3); shorter than the configured default minimum of 10; crafted to miss exactly one required character class (×4); digits only (×2), lower case only, letters only, no digit, no symbol — each the input a composition rule must reject.FluentRuleTest(4): shorter than themin(12)the admin branch applies; shorter than themin(12)a skipped branch would apply, so passing proves the skip; longer than themax(5)the default branch applies; shorter than the minimum.IntegrationTest(2),StringRuleTest(1),RuleSetTest(1): shorter than the minimum / than themin(12)a skipped branch would apply.RuleSetWithBagTest(1 marker, 2 literals): both values are shorter than themin()rules, so the bag must report them.tests/Architecture/NoLiteralCredentialsTest.php,minFiles: 143(159 files scanned).laranail/package-toolsfloor raised from^0.1.3to^0.1.9, the first release withTestCredentialsand the guard (laranail rule 3).[Unreleased]→### Changed.Verification (local, PHP 8.5)
activeUrltests (FluentRuleTest"validates activeUrl shortcut",StringRuleTest"validates string with activeUrl"), which resolve real DNS and cannot in the local sandbox; this PR does not touch them.laranail-pint --test: passed.'password' => '…'appended toIntegrationTest.phpturned the guard red, naming the file and line; reverted withgit checkout.Follow-up: package-tools 0.1.10
laranail/package-toolsfloor raised to^0.1.10.NoLiteralCredentialsTestgains a second test,assertCredentialPurposesAreWordsIn()(same dir,minFiles: 143).TestCredentials::password()call with a hyphenated purpose turned the new test red; the file was restored and nothing of it is committed.activeUrltests that need real DNS, which this machine's sandbox cannot resolve.