RomanNum3ral
/
gstack
mirror of https://github.com/garrytan/gstack.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

test: assemble the planted PEM at runtime so the fixture never trips the prepush guard 

The repo's own credential guard scans pushed diffs and correctly
blocked these fixtures: the engine flags any one-line BEGIN…END
spelling regardless of body. Header, body, and footer are now joined
at runtime, so the file and every diff of it stay clean while the
scanner under test still receives the true live shape.
This commit is contained in:
Garry Tan 2026-08-15 07:45:51 -07:00
parent 19cb4062c2
commit adfacdf15a
No known key found for this signature in database
GPG Key ID: C1F69E85C74EFE1D
1 changed files with 11 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
test/gate-secret-scan.test.ts
View File

@ -35,9 +35,18 @@ describe("gate-secret-scan.mjs exit contract", () => {
expect(r.out).toContain("0 high");
});
// The planted PEM is assembled at runtime — header split included — so this
// FILE never carries a live-format private key: the repo's own prepush
// credential guard scans pushed diffs and (correctly) blocks any one-line
// BEGIN…END spelling regardless of body. The scanner under test still
// receives the true live shape.
const PEM_BEGIN = ["-----BEGIN RSA ", "PRIVATE KEY-----"].join("");
const PEM_END = ["-----END RSA ", "PRIVATE KEY-----"].join("");
const PLANTED_PEM_BODY = ["MIIEow", "IBAAKC", "AQEA"].join("");
test("a HIGH credential in an added line fails the gate", () => {
const r = scan(
"+-----BEGIN RSA PRIVATE KEY-----\n+MIIEowIBAAKCAQEA\n+-----END RSA PRIVATE KEY-----\n",
`+${PEM_BEGIN}\n+${PLANTED_PEM_BODY}\n+${PEM_END}\n`,
);
expect(r.code).toBe(1);
expect(r.out).toContain("1 high");
@ -45,7 +54,7 @@ describe("gate-secret-scan.mjs exit contract", () => {
test("removed lines and context are ignored — only additions are scanned", () => {
const r = scan(
"------BEGIN RSA PRIVATE KEY-----\n-MIIEowIBAAKCAQEA\n-----END RSA PRIVATE KEY-----\n+just an addition\n",
`-${PEM_BEGIN}\n-${PLANTED_PEM_BODY}\n${PEM_END}\n+just an addition\n`,
);
expect(r.code).toBe(0);
});