From f439962c352da243ef7aaa5d64cd26bb0423b5d4 Mon Sep 17 00:00:00 2001
From: Imani Manyara <imanimanyara@users.noreply.github.com>
Date: Mon, 19 Oct 2026 11:27:10 -0400
Subject: [PATCH] Guard the tests against literal credentials

Secret scanners cannot tell a test password from a leaked one, and report
both. GitGuardian raised 28 incidents across laranail by 2026-10-18, 27 of
them test literals or false positives, each closed by hand. This guard
fails the suite on a literal credential, and on a TestCredentials purpose
that is not a single word, so the next one never reaches a push.

laranail/package-tools moves to ^0.1.10, which ships the purpose check.
---
 CHANGELOG.md                                  |  4 ++++
 composer.json                                 |  2 +-
 .../Architecture/NoLiteralCredentialsTest.php | 21 +++++++++++++++++++
 3 files changed, 26 insertions(+), 1 deletion(-)
 create mode 100644 tests/Architecture/NoLiteralCredentialsTest.php

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 906a2a8..ba42808 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -28,6 +28,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Changed
 
+- A guard now keeps literal credentials out of the tests, and every credential generated with
+  `TestCredentials` named with a single word, so secret scanning has nothing to report.
+  `laranail/package-tools` is raised to `^0.1.10`, which ships the purpose check.
+
 - The `repositories` block replaces Packagist with a copy that excludes `laranail/*`, so
   `laranail/package-tools` can only resolve from its VCS repository and never from a stale
   Packagist copy of the same name. This is the family's standard block.
diff --git a/composer.json b/composer.json
index e9c1abf..3c58f3c 100644
--- a/composer.json
+++ b/composer.json
@@ -35,7 +35,7 @@
         "laravel/pint": "^1.30",
         "orchestra/testbench": "^11.1",
         "pestphp/pest": "^5.1",
-        "laranail/package-tools": "^0.1"
+        "laranail/package-tools": "^0.1.10"
     },
     "autoload": {
         "psr-4": {
diff --git a/tests/Architecture/NoLiteralCredentialsTest.php b/tests/Architecture/NoLiteralCredentialsTest.php
new file mode 100644
index 0000000..f2308d7
--- /dev/null
+++ b/tests/Architecture/NoLiteralCredentialsTest.php
@@ -0,0 +1,21 @@
+<?php
+
+declare(strict_types=1);
+
+use Simtabi\Laranail\Package\Tools\Testing\AssertsNoLiteralCredentials;
+
+/*
+ * Secret scanning cannot tell a test password from a leaked one, and reports both. Tests take
+ * their credentials from TestCredentials at run time; this fails on any literal left behind.
+ */
+uses(AssertsNoLiteralCredentials::class);
+
+it('keeps literal credentials out of the tests', function (): void {
+    $this->assertNoLiteralCredentialsIn([dirname(__DIR__)], minFiles: 4);
+    expect(true)->toBeTrue();
+});
+
+it('names every generated credential with a single word', function (): void {
+    $this->assertCredentialPurposesAreWordsIn([dirname(__DIR__)], minFiles: 4);
+    expect(true)->toBeTrue();
+});