egbt/secrets
1
0
Fork 0
Code Issues Pull requests Projects Releases 13 Packages Wiki Activity Actions

fix: pre-landing review fixes (heal ordering, key untrack, content-aware gitignore)

Browse source 
Red-team + specialist findings from /ship pre-landing review:

- CRITICAL: ensure_store_protections ran BEFORE `git pull --ff-only` in
  commit_and_push_secrets; a pull bringing history without .gitignore
  left the post-pull window unprotected and `git add -A` committed AND
  pushed key.txt (reproduced end-to-end). Heal now runs after the pull,
  immediately before staging.
- CRITICAL: .gitignore can't untrack an already-tracked key.txt. Heal
  now defensively `git rm --cached`s a tracked key with a history-scrub
  warning.
- Content-aware heal: a present .gitignore missing the key.txt line is
  rewritten, not skipped (security specialist).
- Init guard now renders the real sanitized clone URL from
  .secrets-store when available, mirroring EGB-282's check_initialized.
- Tests: positive heal-message assertions, non-empty key guard in the
  init test, 4 new regression tests (126 total).
This commit is contained in:
Brian Majewski 2026-06-05 10:14:46 -07:00
parent 5865c40d77
commit 2a7afc34dd
3 changed files with 82 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

60
test/secrets.bats
View file

@ -1484,6 +1484,8 @@ gradle_project() {
# `secrets init` instead of cloning their secrets repo.
mkdir -p "$SECRETS_DIR"
age-keygen -o "$SECRETS_DIR/key.txt" 2>/dev/null
# Guard against a vacuous '' = '' comparison if age-keygen failed
[ -s "$SECRETS_DIR/key.txt" ]
local key_before
key_before=$(cat "$SECRETS_DIR/key.txt")
@ -1503,6 +1505,7 @@ gradle_project() {
run "$SECRETS_BIN" push
[ "$status" -eq 0 ]
[[ "$output" == *"Restored store .gitignore"* ]]
[ -f "$SECRETS_DIR/.gitignore" ]
grep -q "key.txt" "$SECRETS_DIR/.gitignore"
# key.txt must never be tracked (push does `git add -A` in the store)
@ -1560,6 +1563,7 @@ gradle_project() {
run "$SECRETS_BIN" push
[ "$status" -eq 0 ]
[[ "$output" == *"Reinstalled pre-commit hook"* ]]
[ -x "$SECRETS_DIR/.git/hooks/pre-commit" ]
}
@ -1597,3 +1601,59 @@ gradle_project() {
grep -qF '!**/.env.*.age' "$SECRETS_DIR/.gitignore"
grep -qF '!**/.dev.vars.age' "$SECRETS_DIR/.gitignore"
}
@test "push heals .gitignore removed by remote history before staging (key never pushed)" {
init_with_remote
create_project_dir
"$SECRETS_BIN" push >/dev/null 2>&1
# Remote history drops .gitignore (e.g. an old machine committed without it)
git clone -q "$REMOTE_DIR" "$TEST_TMPDIR/other"
git -C "$TEST_TMPDIR/other" rm -q .gitignore
git -C "$TEST_TMPDIR/other" -c user.email=t@t -c user.name=t commit -qm "drop gitignore"
git -C "$TEST_TMPDIR/other" push -q
echo "B=2" >> .env
run "$SECRETS_BIN" push
[ "$status" -eq 0 ]
[ -f "$SECRETS_DIR/.gitignore" ]
run git -C "$SECRETS_DIR" ls-files
[[ "$output" != *"key.txt"* ]]
}
@test "push untracks a previously committed key.txt with a warning" {
init_with_remote
# Simulate legacy damage: key.txt got committed in the past
git -C "$SECRETS_DIR" add -f key.txt
git -C "$SECRETS_DIR" -c user.email=t@t -c user.name=t commit -qm "oops"
create_project_dir
run "$SECRETS_BIN" push
[ "$status" -eq 0 ]
[[ "$output" == *"key.txt was tracked"* ]]
run git -C "$SECRETS_DIR" ls-files
[[ "$output" != *"key.txt"* ]]
}
@test "push rewrites a store .gitignore that is missing the key.txt line" {
init_with_remote
printf '%s\n' '**/.env' > "$SECRETS_DIR/.gitignore"
create_project_dir
run "$SECRETS_BIN" push
[ "$status" -eq 0 ]
grep -qx 'key.txt' "$SECRETS_DIR/.gitignore"
run git -C "$SECRETS_DIR" ls-files
[[ "$output" != *"key.txt"* ]]
}
@test "init guard renders the real clone URL when .secrets-store carries a remote" {
mkdir -p "$HOME/.secrets-work"
age-keygen -o "$HOME/.secrets-work/key.txt" 2>/dev/null
[ -s "$HOME/.secrets-work/key.txt" ]
cd "$WORK_DIR"
echo "work git@example.com:me/secrets-work.git" > .secrets-store
run "$SECRETS_BIN" init
[ "$status" -eq 1 ]
[[ "$output" == *"git clone git@example.com:me/secrets-work.git"* ]]
}