From d69a074d50dc7abf7f9ce99bd85f8318805efec6 Mon Sep 17 00:00:00 2001 From: Will Gordon Date: Sat, 25 Jul 2026 15:00:25 -0400 Subject: [PATCH] NO-ISSUE: Exempt fake test-fixture credentials from secrets check MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The no-hardcoded-secrets check flags any literal assigned to a username/password-typed field, including generic unit-test fixture values with no relation to a real credential (e.g. Go test helpers verifying that connection details round-trip through application code unmodified). The existing admin/admin exception doesn't cover this: it's scoped to developer setup/maintenance scripts hitting a real system's documented default login, not test fixtures. Added an exception with three concrete, ANDed conditions rather than a vague "looks fake" judgment call: the file must match a conventional unit-test naming pattern, the identifier holding the value must carry a test/fixture/mock/fake prefix or suffix, and the value itself must not match any real-secret shape the check already looks for (API keys/tokens, private-key material, base64/hex blobs, credential- bearing URLs, vendor-specific patterns). All three must hold together — neither a test-file path alone nor a plausible-looking value alone is enough. This keeps the check's ability to catch a real secret accidentally pasted into a test file. Assisted-by: Claude Code Signed-off-by: Will Gordon --- .coderabbit.yaml | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/.coderabbit.yaml b/.coderabbit.yaml index e659986..bd50bcc 100644 --- a/.coderabbit.yaml +++ b/.coderabbit.yaml @@ -350,6 +350,23 @@ reviews: developer setup or maintenance scripts (e.g., Keycloak token requests with username=admin, password=admin). These are standard defaults for local development environments. + + Do NOT flag a credential-shaped literal in a unit test file + when ALL three hold: (1) the file matches a conventional + unit-test naming pattern (e.g. *_test.go, *_test.py, + test_*.py, *.test.{js,ts}, *.spec.{js,ts}, *_test.rb, + *Test.java); (2) the identifier holding the literal (const, + var, or local variable — not the struct/field name it's + assigned into) is named with a test/fixture/mock/fake + prefix or suffix (e.g. testBackendPassword, fixtureAPIKey, + mockToken); and (3) the value does not itself match any + real-secret shape this check already looks for (no + recognizable API-key/token format, no private-key material, + no base64/hex blob >32 chars, no URL with embedded + credentials, no match to a real vendor's credential + pattern). All three conditions must hold — a test-file path + alone, or a plausible-looking value alone, is not + sufficient. mode: "error" - name: "no-weak-crypto"