Repository navigation
Generate test credentials at run time - #50
Merged
Merged
Conversation
GitGuardian raised 28 incidents across laranail, nearly all of them literal credentials in tests. Redaction inputs, signing secrets, LLM API keys and HIBP fixture passwords are now generated per run with TestCredentials. Four literals stay, marked with the reason: a weak password the zxcvbn rule must reject, two malformed config values and a validation rule. A PHPUnit guard fails the suite on any literal left behind, in a new Architecture suite. Raises the laranail/package-tools floor to ^0.1.9, the first release with these helpers.
️✅ There are no secrets present in this pull request anymore.If these secrets were true positive and are still valid, we highly recommend you to revoke them. 🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request. |
A marker trailing a literal's own line put that line in the pull request's diff, and GitGuardian then reported the two malformed config values already on main as passwords. On the line above, the literal's line is unchanged from main and stays out of the diff.
Secret scanning reads a compound purpose passed to TestCredentials, such as a hyphenated one, as the password itself, so a generated credential can be reported as a leaked one. A single plain lowercase word never has been. Rename every purpose to one word, and switch on assertCredentialPurposesAreWordsIn() so a new compound purpose fails the suite instead of reaching a pull request. package-tools 0.1.10 ships that check and a scanner that no longer reports some lines earlier releases did, so the floor rises to ^0.1.10 and exemption markers the scanner no longer needs are removed.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
GitGuardian raised 28 incidents across laranail by 2026-10-18; 27 were test literals or false positives, each closed by hand. A value generated at run time never reaches the repository, so there is nothing to report.
What changed
laranail/package-toolsfloor raised to^0.1.9(require-dev), the first release shippingTestCredentialsandAssertsNoLiteralCredentials.AccessLogMiddlewareTest: the password, token and nested API key fed to redaction, and the value stored verbatim under an override, are generated; the redaction assertions are unchanged.CrudControllerTest,AuditableTest: the guarded/hiddensecretattribute values are generated; the audit test still proves the value never appears in the stored JSON.FacadesTest: the OpenAI key keeps itssk-shape viasprintf('sk-%s', TestCredentials::secret('openai')); Gemini and Claude keys are generated.TokenTest: the HMAC signing secret (8 sites) isTestCredentials::secret('signing').RejectCommonPasswordsTest: the HIBP breached-password fixture (its hash is faked from the value) and the never-transmit plaintext are generated.RejectCommonPasswordsTest:'Summer2024'-- a weak input the zxcvbn rule must reject.SecurityDataTest(2):'not-an-array','not-a-list'undersecurity.passwords-- malformed config values, not credentials.ApiResponseTraitFeatureTest:'password' => 'required'-- a validation rule, not a credential.tests/Architecture/NoLiteralCredentialsTest.phpscanstests/(127 files, floor 114), in a newArchitecturetestsuite inphpunit.xml.[Unreleased]section with the entry.Verification
$probe = ['secret' => 's3cr3t'];toTokenTest.php, the guard failed naming that line, then restored the file withgit checkout.Follow-up: package-tools 0.1.10
This commit raises the
laranail/package-toolsfloor to^0.1.10and adds a second test toNoLiteralCredentialsTest,assertCredentialPurposesAreWordsIn(), which fails the suite on any generated-credential purpose that is not a single plain lowercase word. Renamed 0 purposes (all were already single words). Markers removed: 3 whole comment lines --SecurityDataTest.php(two) andApiResponseTraitFeatureTest.php(one); both files now matchmainexactly, so neither literal line is in this diff. TheRejectCommonPasswordsTestmarker is still needed and stays.Red proof: a scratch line calling
TestCredentials::password()with a hyphenated purpose turned the new test red; the file was restored withgit checkout HEAD, and nothing committed contains it. Local gates: Pest, laranail-pint, PHPStan and Rector all pass.