From bf219153dbdae123de4fbb673ca3dd578d8791ca Mon Sep 17 00:00:00 2001 From: Daniel McCoy Stephenson Date: Tue, 1 Sep 2026 04:19:24 +0000 Subject: [PATCH] test: use a non-credential-shaped sentinel in the leak tests The leak tests hand the client a stand-in secret and assert it never reaches a returned value, a URL or an error message. The stand-in was literally `ghp_...`-prefixed. That was fine while the repo was private; now that it is public, GitHub secret scanning matches the literal, files a false-positive alert, and push protection can block any push that touches the line. The alert is noise, but recurring noise is worse than no alert: it trains people to dismiss the one that is real. The tests are unchanged in what they check. They only ever needed a distinctive, greppable sentinel to assert the absence of, and `sentinel-not-a-real-credential-leak-canary` does that job identically while matching no scanner pattern and carrying no entropy. Both files carry a comment explaining why the fixture deliberately does not look authentic, so it does not get "corrected" back later. Verified by removing the redaction in the Python client: the leak test fails on the sentinel exactly as it did on the old value. --- js/test/client.test.ts | 14 +++++++++++--- python/tests/test_client.py | 12 +++++++++++- 2 files changed, 22 insertions(+), 4 deletions(-) diff --git a/js/test/client.test.ts b/js/test/client.test.ts index a968d5c..2dd9f4d 100644 --- a/js/test/client.test.ts +++ b/js/test/client.test.ts @@ -5,11 +5,19 @@ import {createDocsClient, type MarkdownFetch} from '../src/client'; const REPO = 'acme-guild/handbook'; const DOCS = ['handbook/rules.md', 'handbook/getting-started.md']; -// A credential-shaped string, and a body that quotes it back. A real GitHub -// error body does not echo the credential, but an upstream that did — a +// The stand-in secret, and a body that quotes it back. A real GitHub error +// body does not echo the credential, but an upstream that did — a // misconfigured proxy, a future API, an intermediary — must not be able to // launder it through this package. -const TOKEN = 'ghp_a1b2c3d4e5f6g7h8i9j0_secretvalue'; +// +// Deliberately NOT shaped like a real credential: no `ghp_` / `gho_` / +// `github_pat_` prefix and no random-looking entropy, because this repo is +// public and a realistic-looking literal trips GitHub secret scanning, which +// files a false-positive alert and can block pushes that touch this line. The +// leak assertions only need a distinctive, greppable sentinel to look for, and +// this string is exactly as good at that job. Please do not "fix" it back into +// something that looks authentic. +const TOKEN = 'sentinel-not-a-real-credential-leak-canary'; const LEAKY_BODY = `{"message":"Bad credentials: ${TOKEN}","documentation_url":"https://docs.github.com/rest"}`; const okResponse = (text: string): Response => diff --git a/python/tests/test_client.py b/python/tests/test_client.py index 414d512..544c821 100644 --- a/python/tests/test_client.py +++ b/python/tests/test_client.py @@ -23,7 +23,17 @@ ) REPO = "acme-guild/handbook" -TOKEN = "ghp_a1b2c3d4e5f6g7h8i9j0_secretvalue" +# The stand-in secret handed to the client. The leak tests assert this exact +# string never reaches a returned value, a URL or an error message. +# +# Deliberately NOT shaped like a real credential: no `ghp_` / `gho_` / +# `github_pat_` prefix and no random-looking entropy, because this repo is +# public and a realistic-looking literal trips GitHub secret scanning, which +# files a false-positive alert and can block pushes that touch this line. The +# assertions only need a distinctive, greppable sentinel to look for, and this +# string is exactly as good at that job. Please do not "fix" it back into +# something that looks authentic. +TOKEN = "sentinel-not-a-real-credential-leak-canary" ROOTS = ("handbook", "policies", "players")