From 325ce1b1c15f44ad6cf8868532a7755524490e5b Mon Sep 17 00:00:00 2001
From: Imani Manyara <imanimanyara@users.noreply.github.com>
Date: Mon, 19 Oct 2026 11:21:26 -0400
Subject: [PATCH] Guard the tests against literal credentials

Secret scanners cannot tell a test password from a leaked one, and
report both. GitGuardian raised 28 incidents across laranail by
2026-10-18, and 27 of them were test literals or false positives, each
closed by hand.

This adds package-tools' shared guard: one test fails on any literal
credential left in the tests, and a second fails on any TestCredentials
purpose that is not a single lowercase word, since scanners read a
compound purpose as the password itself. It keeps the next incident out
rather than closing it after the push. Requires laranail/package-tools
^0.1.10, the first release that ships both checks.
---
 CHANGELOG.md                                  |  3 +++
 composer.json                                 |  2 +-
 .../Architecture/NoLiteralCredentialsTest.php | 22 +++++++++++++++++++
 3 files changed, 26 insertions(+), 1 deletion(-)
 create mode 100644 tests/Architecture/NoLiteralCredentialsTest.php

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 27d30ba..fe31c70 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,6 +9,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Changed
 
+- A guard now keeps literal credentials out of the tests, and keeps every generated credential's
+  purpose a single word, because secret scanners cannot tell a test password from a leaked one.
+  `laranail/package-tools`, which ships it, is now required at `^0.1.10`.
 - `require` declares what `src/` uses directly: `illuminate/routing` (the `Route` facade in the
   provider) and `laravel/framework`, for `Illuminate\Foundation\Http\FormRequest` in
   `LookupRequest`, which has no split package. `laravel/framework` replaces every `illuminate/*` split, so an application installs nothing
diff --git a/composer.json b/composer.json
index c5b1712..4e684d2 100644
--- a/composer.json
+++ b/composer.json
@@ -41,7 +41,7 @@
         "illuminate/support": "^13.0",
         "illuminate/validation": "^13.0",
         "laranail/atlas": "^0.1",
-        "laranail/package-tools": "^0.1",
+        "laranail/package-tools": "^0.1.10",
         "laravel/framework": "^13.0"
     },
     "require-dev": {
diff --git a/tests/Architecture/NoLiteralCredentialsTest.php b/tests/Architecture/NoLiteralCredentialsTest.php
new file mode 100644
index 0000000..9810473
--- /dev/null
+++ b/tests/Architecture/NoLiteralCredentialsTest.php
@@ -0,0 +1,22 @@
+<?php
+
+declare(strict_types=1);
+
+use Simtabi\Laranail\Package\Tools\Testing\AssertsNoLiteralCredentials;
+
+/*
+ * Secret scanning cannot tell a test password from a leaked one, and reports both. Tests take
+ * their credentials from TestCredentials at run time; these fail on any literal left behind, and
+ * on any generated credential whose purpose is not a single word.
+ */
+uses(AssertsNoLiteralCredentials::class);
+
+it('keeps literal credentials out of the tests', function (): void {
+    $this->assertNoLiteralCredentialsIn([dirname(__DIR__)], minFiles: 5);
+    expect(true)->toBeTrue();
+});
+
+it('names every generated credential with a single word', function (): void {
+    $this->assertCredentialPurposesAreWordsIn([dirname(__DIR__)], minFiles: 5);
+    expect(true)->toBeTrue();
+});