CalvinBackup/gstack
1
0
Fork 0
mirror of https://github.com/garrytan/gstack.git synced 2026-09-09 14:38:59 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix(test): assemble redact fixtures at runtime — the guard caught its own wave

Browse Source 
The pre-push redact guard BLOCKED this branch's first push: the wave's new
scan-range tests carried live-FORMAT fake credentials as literals (3 AWS key
shapes + a password-bearing DB URL), and the guard scans pushed diff bytes.
Same dogfood moment as the v1.64 wave, same rule: assemble the fixture at
runtime so the diff never carries a credential shape, never bypass the guard.
Runtime strings stay live-format for the hook under test. The guard works.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Garry Tan
2026-08-16 11:43:03 -07:00
co-authored by Claude Fable 5
parent fb66780112
commit a2c1dff78b
1 changed files with 18 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/redact-prepush-scan-range.test.ts
+18 -9
View File
@@ -73,6 +73,15 @@ beforeEach(() => {
});
afterEach(() => rmSync(dir, { recursive: true, force: true }));
// Live-FORMAT fakes assembled at runtime so the pushed diff of THIS file never
// contains a credential-shaped literal — the pre-push guard scans diff bytes,
// and the v1.64 wave's dogfood rule stands: assemble the fixture, never bypass
// the guard. The runtime strings stay live-format for the hook under test.
const FAKE_DB_URL = ["postgresql://user:pass", "@db.example.com/x"].join("");
const FAKE_AWS_SECRETX = ["AKIA", "IOSFODNN7SECRETX"].join("");
const FAKE_AWS_RESOLV = ["AKIA", "IOSFODNN7RESOLV"].join("");
const FAKE_AWS_NOREMOT = ["AKIA", "IOSFODNN7NOREMOT"].join("");
/** Give the repo an "origin" whose main carries a fixture we did not write. */
function setUpRemoteWithForeignFixture(): void {
const remote = mkdtempSync(join(tmpdir(), "gstack-prepush-remote-"));
@@ -80,7 +89,7 @@ function setUpRemoteWithForeignFixture(): void {
run(["remote", "add", "origin", remote]);
run(["push", "-q", "origin", "main"]);
// Someone else lands a placeholder connection string on main.
commit("fixtures/db.ts", 'export const URL = "postgresql://user:pass@db.example.com/x";\n', "someone else's fixture");
commit("fixtures/db.ts", `export const URL = "${FAKE_DB_URL}";\n`, "someone else's fixture");
run(["push", "-q", "origin", "main"]);
run(["fetch", "-q", "origin"]);
}
@@ -95,7 +104,7 @@ describe("a catch-up merge does not re-scan already-published content", () => {
const scanned = addedOnly(addedLinesFromNewCommits(dir));
expect(scanned).toContain("export const mine = 1;");
expect(scanned).not.toContain("postgresql://user:pass@db.example.com/x");
expect(scanned).not.toContain(FAKE_DB_URL);
});
test("the old two-dot range DID re-scan it — this is the bug", () => {
@@ -107,7 +116,7 @@ describe("a catch-up merge does not re-scan already-published content", () => {
// origin/feature does not exist yet, so the old code diffed against the
// remote's main — dragging in every catch-up commit.
const scanned = addedOnly(addedLinesFromTwoDot(dir, "HEAD~2"));
expect(scanned).toContain("postgresql://user:pass@db.example.com/x");
expect(scanned).toContain(FAKE_DB_URL);
});
});
@@ -115,9 +124,9 @@ describe("narrowing the range does not narrow coverage", () => {
test("a secret in a new commit is still scanned", () => {
setUpRemoteWithForeignFixture();
run(["checkout", "-q", "-b", "feature", "main"]);
commit("leak.ts", 'const k = "AKIAIOSFODNN7SECRETX";\n', "oops");
commit("leak.ts", `const k = "${FAKE_AWS_SECRETX}";\n`, "oops");
expect(addedOnly(addedLinesFromNewCommits(dir))).toContain("AKIAIOSFODNN7SECRETX");
expect(addedOnly(addedLinesFromNewCommits(dir))).toContain(FAKE_AWS_SECRETX);
});
test("a secret introduced while RESOLVING a merge is still scanned", () => {
@@ -138,15 +147,15 @@ describe("narrowing the range does not narrow coverage", () => {
run(["fetch", "-q", "origin"]);
run(["checkout", "-q", "feature"]);
spawnSync("git", ["merge", "--no-edit", "main"], { cwd: dir, encoding: "utf8" }); // conflicts
writeFileSync(join(dir, "conflict.txt"), 'resolved AKIAIOSFODNN7RESOLV\n');
writeFileSync(join(dir, "conflict.txt"), `resolved ${FAKE_AWS_RESOLV}\n`);
run(["add", "conflict.txt"]);
run(["commit", "-q", "--no-edit"]);
expect(addedOnly(addedLinesFromNewCommits(dir))).toContain("AKIAIOSFODNN7RESOLV");
expect(addedOnly(addedLinesFromNewCommits(dir))).toContain(FAKE_AWS_RESOLV);
});
test("everything is scanned when no remote exists at all", () => {
commit("leak.ts", 'const k = "AKIAIOSFODNN7NOREMOT";\n', "no remote");
expect(addedOnly(addedLinesFromNewCommits(dir))).toContain("AKIAIOSFODNN7NOREMOT");
commit("leak.ts", `const k = "${FAKE_AWS_NOREMOT}";\n`, "no remote");
expect(addedOnly(addedLinesFromNewCommits(dir))).toContain(FAKE_AWS_NOREMOT);
});
});