From 4848f538da93492b8fbf8be28f94c38794eb518f Mon Sep 17 00:00:00 2001
From: Imani Manyara <imanimanyara@users.noreply.github.com>
Date: Mon, 19 Oct 2026 11:21:26 -0400
Subject: [PATCH] Guard the tests against literal credentials

Secret scanners cannot tell a test password from a leaked one, and
report both. GitGuardian raised 28 incidents across laranail by
2026-10-18, and 27 of them were test literals or false positives, each
closed by hand.

This adds package-tools' shared guard: one test fails on any literal
credential left in the tests, and a second fails on any TestCredentials
purpose that is not a single lowercase word, since scanners read a
compound purpose as the password itself. It keeps the next incident out
rather than closing it after the push. Requires laranail/package-tools
^0.1.10, the first release that ships both checks.
---
 CHANGELOG.md                                  |  3 +++
 composer.json                                 |  2 +-
 .../Architecture/NoLiteralCredentialsTest.php | 22 +++++++++++++++++++
 3 files changed, 26 insertions(+), 1 deletion(-)
 create mode 100644 tests/Architecture/NoLiteralCredentialsTest.php

diff --git a/CHANGELOG.md b/CHANGELOG.md
index bc070c2..5f5891b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -33,6 +33,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Changed
 
+- A guard now keeps literal credentials out of the tests, and keeps every generated credential's
+  purpose a single word, because secret scanners cannot tell a test password from a leaked one.
+  `laranail/package-tools`, which ships it, is now required at `^0.1.10`.
 - **The commands are `laranail::git-commit-checker.install` and
   `laranail::git-commit-checker.pre-commit-hook`**, the family's `laranail::<slug>.<command>` shape.
   The hook script `install` writes calls the scoped name. A local copy of `laranail/console`'s
diff --git a/composer.json b/composer.json
index ab0e8f8..172edb9 100644
--- a/composer.json
+++ b/composer.json
@@ -44,7 +44,7 @@
         "laravel/pint": "^1.30",
         "orchestra/testbench": "^11.1",
         "pestphp/pest": "^5.1",
-        "laranail/package-tools": "^0.1"
+        "laranail/package-tools": "^0.1.10"
     },
     "extra": {
         "laravel": {
diff --git a/tests/Architecture/NoLiteralCredentialsTest.php b/tests/Architecture/NoLiteralCredentialsTest.php
new file mode 100644
index 0000000..9810473
--- /dev/null
+++ b/tests/Architecture/NoLiteralCredentialsTest.php
@@ -0,0 +1,22 @@
+<?php
+
+declare(strict_types=1);
+
+use Simtabi\Laranail\Package\Tools\Testing\AssertsNoLiteralCredentials;
+
+/*
+ * Secret scanning cannot tell a test password from a leaked one, and reports both. Tests take
+ * their credentials from TestCredentials at run time; these fail on any literal left behind, and
+ * on any generated credential whose purpose is not a single word.
+ */
+uses(AssertsNoLiteralCredentials::class);
+
+it('keeps literal credentials out of the tests', function (): void {
+    $this->assertNoLiteralCredentialsIn([dirname(__DIR__)], minFiles: 5);
+    expect(true)->toBeTrue();
+});
+
+it('names every generated credential with a single word', function (): void {
+    $this->assertCredentialPurposesAreWordsIn([dirname(__DIR__)], minFiles: 5);
+    expect(true)->toBeTrue();
+});