From 97163958f1339ce9ff609ce176eb9b0976006401 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Tue, 21 Jul 2026 16:27:41 +0100 Subject: [PATCH] ci: mark deliberate secret-shaped test fixtures for rust-secrets MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit standards' `rust-secrets` job becomes blocking outside `./src` on 2026-08-21. The lines tagged here are genuine matches on genuine secret-shaped literals — they are test data, not credentials — so they take the explicit per-line pragma rather than a pattern loophole that would weaken the gate for every repo. plugins/secret-scanner/src/lib.rs holds this repo's OWN secret-detector test corpus — a scanner's fixtures necessarily look like secrets. The pragma sits inside the multi-line r#"…"# fixture as a JS-style comment, which does not change what the test exercises: the plugin's own password[:=]\\s*["']… regex still matches, so assert!(!findings.is_empty()) still holds. Verified: `rust-secrets` (extracted from standards' shipping YAML) exits 0 on this tree with RUST_TODAY=2026-09-01, i.e. after the cutoff. Scope: this commit touches ONLY Rust sources. The secret-scanner re-pin is deliberately NOT bundled — this repo is one of the 22 the sweep flagged, where gitleaks findings survive the estate baseline, and switching it to the real gate needs its own triage. Co-Authored-By: Claude Opus 4.8 --- plugins/secret-scanner/src/lib.rs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/plugins/secret-scanner/src/lib.rs b/plugins/secret-scanner/src/lib.rs index adabade..53243a2 100644 --- a/plugins/secret-scanner/src/lib.rs +++ b/plugins/secret-scanner/src/lib.rs @@ -156,7 +156,7 @@ mod tests { let plugin = SecretScannerPlugin::new(); let content = r#" const api_key = "AKIAIOSFODNN7EXAMPLE"; -const password = "super_secret_password_12345"; +const password = "super_secret_password_12345"; // scanner-allow: rust-secrets "#; let findings = plugin.scan_content(content);