Guard the tests against literal credentials

CHANGELOG.md

@@ -33,6 +33,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Changed
 
+- A guard now keeps literal credentials out of the tests, and keeps every generated credential's
+  purpose a single word, because secret scanners cannot tell a test password from a leaked one.
+  `laranail/package-tools`, which ships it, is now required at `^0.1.10`.
 - **The commands are `laranail::git-commit-checker.install` and
   `laranail::git-commit-checker.pre-commit-hook`**, the family's `laranail::<slug>.<command>` shape.
   The hook script `install` writes calls the scoped name. A local copy of `laranail/console`'s

composer.json

@@ -44,7 +44,7 @@
         "laravel/pint": "^1.30",
         "orchestra/testbench": "^11.1",
         "pestphp/pest": "^5.1",
-        "laranail/package-tools": "^0.1"
+        "laranail/package-tools": "^0.1.10"
     },
     "extra": {
         "laravel": {

tests/Architecture/NoLiteralCredentialsTest.php

@@ -0,0 +1,22 @@
+<?php
+
+declare(strict_types=1);
+
+use Simtabi\Laranail\Package\Tools\Testing\AssertsNoLiteralCredentials;
+
+/*
+ * Secret scanning cannot tell a test password from a leaked one, and reports both. Tests take
+ * their credentials from TestCredentials at run time; these fail on any literal left behind, and
+ * on any generated credential whose purpose is not a single word.
+ */
+uses(AssertsNoLiteralCredentials::class);
+
+it('keeps literal credentials out of the tests', function (): void {
+    $this->assertNoLiteralCredentialsIn([dirname(__DIR__)], minFiles: 5);
+    expect(true)->toBeTrue();
+});
+
+it('names every generated credential with a single word', function (): void {
+    $this->assertCredentialPurposesAreWordsIn([dirname(__DIR__)], minFiles: 5);
+    expect(true)->toBeTrue();
+});