From adfacdf15a844461e9795075cfa85df2bd700711 Mon Sep 17 00:00:00 2001
From: Garry Tan <garrytan@gmail.com>
Date: Sat, 15 Aug 2026 07:45:51 -0700
Subject: [PATCH] test: assemble the planted PEM at runtime so the fixture
 never trips the prepush guard
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The repo's own credential guard scans pushed diffs and correctly
blocked these fixtures: the engine flags any one-line BEGIN…END
spelling regardless of body. Header, body, and footer are now joined
at runtime, so the file and every diff of it stay clean while the
scanner under test still receives the true live shape.
---
 test/gate-secret-scan.test.ts | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/test/gate-secret-scan.test.ts b/test/gate-secret-scan.test.ts
index 24f2a858b..2d31a7012 100644
--- a/test/gate-secret-scan.test.ts
+++ b/test/gate-secret-scan.test.ts
@@ -35,9 +35,18 @@ describe("gate-secret-scan.mjs exit contract", () => {
     expect(r.out).toContain("0 high");
   });
 
+  // The planted PEM is assembled at runtime — header split included — so this
+  // FILE never carries a live-format private key: the repo's own prepush
+  // credential guard scans pushed diffs and (correctly) blocks any one-line
+  // BEGIN…END spelling regardless of body. The scanner under test still
+  // receives the true live shape.
+  const PEM_BEGIN = ["-----BEGIN RSA ", "PRIVATE KEY-----"].join("");
+  const PEM_END = ["-----END RSA ", "PRIVATE KEY-----"].join("");
+  const PLANTED_PEM_BODY = ["MIIEow", "IBAAKC", "AQEA"].join("");
+
   test("a HIGH credential in an added line fails the gate", () => {
     const r = scan(
-      "+-----BEGIN RSA PRIVATE KEY-----\n+MIIEowIBAAKCAQEA\n+-----END RSA PRIVATE KEY-----\n",
+      `+${PEM_BEGIN}\n+${PLANTED_PEM_BODY}\n+${PEM_END}\n`,
     );
     expect(r.code).toBe(1);
     expect(r.out).toContain("1 high");
@@ -45,7 +54,7 @@ describe("gate-secret-scan.mjs exit contract", () => {
 
   test("removed lines and context are ignored — only additions are scanned", () => {
     const r = scan(
-      "------BEGIN RSA PRIVATE KEY-----\n-MIIEowIBAAKCAQEA\n-----END RSA PRIVATE KEY-----\n+just an addition\n",
+      `-${PEM_BEGIN}\n-${PLANTED_PEM_BODY}\n${PEM_END}\n+just an addition\n`,
     );
     expect(r.code).toBe(0);
   });