mirror of
https://github.com/garrytan/gstack.git
synced 2026-11-02 23:14:33 +01:00
garrytanandjacob-wang
0d9ebd27ec
/setup-deploy ran 'echo $RENDER_API_KEY | head -c 4', printing the key's first bytes into the transcript. It now prints only 'RENDER_API_KEY: set' or 'RENDER_API_KEY: not set'. Wording follows the #2971 port of #1096; a test also guards against any setup-deploy command echoing a credential variable. Co-authored-by: jacob-wang <jiayuw794@gmail.com>
36 lines
1.6 KiB
TypeScript
36 lines
1.6 KiB
TypeScript
/**
|
|
* D4 (#1078): /setup-deploy ran `echo $RENDER_API_KEY | head -c 4`, printing
|
|
* the key's first bytes into the transcript. It now reports presence only.
|
|
*/
|
|
import { describe, test, expect } from 'bun:test';
|
|
import { spawnSync } from 'child_process';
|
|
import * as fs from 'fs';
|
|
import * as path from 'path';
|
|
|
|
const SKILL = fs.readFileSync(path.resolve(import.meta.dir, '..', 'setup-deploy', 'SKILL.md'), 'utf-8');
|
|
const KEY = 'rnd_D4testKeyValue1234567890';
|
|
|
|
describe('D4: setup-deploy reports Render key presence, never key bytes', () => {
|
|
const at = SKILL.indexOf('Check only whether the Render API key is set');
|
|
const block = SKILL.slice(at).match(/```bash\n([\s\S]*?)\n```/)?.[1] ?? '';
|
|
|
|
test('the check runs and prints only set / not set', () => {
|
|
expect(at).toBeGreaterThanOrEqual(0);
|
|
const run = (env: Record<string, string>) => spawnSync('bash', ['-c', block], {
|
|
env: { PATH: process.env.PATH!, ...env }, encoding: 'utf-8', timeout: 10_000,
|
|
});
|
|
const set = run({ RENDER_API_KEY: KEY });
|
|
expect(set.stdout).toBe('RENDER_API_KEY: set\n');
|
|
expect(set.stdout).not.toContain(KEY.slice(0, 4));
|
|
expect(run({}).stdout).toBe('RENDER_API_KEY: not set\n');
|
|
});
|
|
|
|
test('no setup-deploy command prints a credential variable value', () => {
|
|
const fences = [...SKILL.matchAll(/```bash\n([\s\S]*?)\n```/g)].map(m => m[1]).join('\n');
|
|
const inline = [...SKILL.matchAll(/`([^`\n]*)`/g)].map(m => m[1]).join('\n');
|
|
for (const text of [fences, inline]) {
|
|
expect(text).not.toMatch(/(echo|printf)[^\n|;]*\$\{?[A-Z0-9_]*(API_KEY|TOKEN|SECRET)\b/);
|
|
}
|
|
});
|
|
});
|