Repository navigation
Generate test credentials at run time - #20
Merged
Merged
Conversation
GitGuardian raised 28 incidents across laranail, nearly all of them literal credentials in tests. This suite holds none, but two route and rate-limiter names read as tokens to the scanner, so they are marked as deliberate, and a guard test now fails the suite on any literal added later. Raises the laranail/package-tools floor to ^0.1.9, the first release that ships the guard.
Secret scanning reads a compound purpose passed to TestCredentials, such as a hyphenated one, as the password itself, so a generated credential can be reported as a leaked one. A single plain lowercase word never has been. Rename every purpose to one word, and switch on assertCredentialPurposesAreWordsIn() so a new compound purpose fails the suite instead of reaching a pull request. package-tools 0.1.10 ships that check and a scanner that no longer reports some lines earlier releases did, so the floor rises to ^0.1.10 and exemption markers the scanner no longer needs are removed.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
GitGuardian raised 28 incidents across laranail by 2026-10-18; 27 were test literals or false positives, each closed by hand. A guard test stops the next one reaching the repository.
What changed
laranail/package-toolsfloor raised to^0.1.9, the first release shippingAssertsNoLiteralCredentialsandTestCredentials.tests/Feature/NamingConventionTest.php, both false positives on a name containingtoken:'licensing.token.issue' => 'laranail-license-kit.token.issue'-- a route name, not a credential.'licensing-token' => 'laranail-license-kit.token'-- a rate-limiter name, not a credential.tests/Architecture/NoLiteralCredentialsTest.phpscanstests/anddatabase/factories/(41 files, floor 37).[Unreleased]entry.Verification
$probe = ['secret' => 'abcd1234'];totests/ArchTest.php, the guard failed naming that line, then restored the file withgit checkout.Follow-up: package-tools 0.1.10
This commit raises the
laranail/package-toolsfloor to^0.1.10and adds a second test toNoLiteralCredentialsTest,assertCredentialPurposesAreWordsIn(), which fails the suite on any generated-credential purpose that is not a single plain lowercase word. Renamed 0 purposes (none were compound). Markers removed: 0 -- the two inNamingConventionTest.php(lines 33 and 39) are no longer needed by 0.1.10, but each trails its literal on the same line, and editing that line would put the literal into this diff, so they stay.Red proof: a scratch line calling
TestCredentials::password()with a hyphenated purpose turned the new test red; the file was restored withgit checkout HEAD, and nothing committed contains it. Local gates: Pest, laranail-pint, PHPStan and Rector all pass.