Repository navigation
Generate test credentials at run time - #75
Merged
Merged
Conversation
GitGuardian raised 28 incidents across laranail by 2026-10-18, and 27 were test literals or false positives closed by hand. A value generated when the suite runs never reaches the repository, so there is nothing to report. Passwords, secrets and tokens in tests/ and the workbench factory now come from package-tools' TestCredentials. Values that must differ (old and new, wrong and right, unconfirmed) use distinct purposes and assert the difference. A new architecture test fails on any literal left behind. The package-tools floor rises to ^0.1.9, the first release that ships both.
Raise the laranail/package-tools floor to ^0.1.10 and switch on its
assertCredentialPurposesAreWordsIn() check beside the literal guard.
GitGuardian reads a compound purpose such as password('smtp-new') as the
password itself; a single plain lowercase word has never been reported,
so the second test keeps every purpose that way.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
GitGuardian raised 28 incidents across laranail by 2026-10-18; 27 were test literals or false positives, each closed by hand. A value generated when the suite runs never reaches the repository, so there is nothing for a scanner to report.
laranail/package-tools0.1.9 shipsTestCredentials(the generator) andAssertsNoLiteralCredentials(the guard).What changed
laranail/package-toolsfloor raised to^0.1.9(the first release withTestCredentials), so prefer-lowest legs resolve it.UpdateUserPasswordTest,ResetUserPasswordTest,AttemptEmailPasswordLoginTest,CreateNewUserTest,UpdateUserProfileInformationTestandTurnstileTest. The workbenchUserFactorypassword is generated too.tests/Architecture/NoLiteralCredentialsTest.phpscanstests/andworkbench/database/factories(24 files, floor 21);tests/Pest.phpnow bindsArchitecture.[Unreleased]→Changedentry.Verification
vendor/bin/pest: 81 passed (173 assertions).laranail-pint --test: passed. (No PHPStan or Rector config in this repo; CI runs pint and the tests.)$leak = ['password' => '<literal>'];toTurnstileTest.phpturned the guard red, naming the file, line and rulenamed; reverted withgit checkout.Follow-up
One commit adopting
laranail/package-tools0.1.10: the floor is now^0.1.10, andNoLiteralCredentialsTestgains a second test,assertCredentialPurposesAreWordsIn()over the same directories and file floor, keeping everyTestCredentialspurpose a single plain lowercase word. Purposes renamed: 0 (all were already single words). Markers removed: 0. CHANGELOG entry updated in place.Red proof: with a scratch
TestCredentials::password('scratch-probe')line appended to the guard file, the purpose test failed naming that line; the file was restored withgit checkout HEAD --and nothing of it is committed.