egbt/secrets
1
0
Fork 0
Code Issues Pull requests Projects Releases 13 Packages Wiki Activity Actions

test: coverage backfill — which UNSAFE marker, malformed-manifest add, dry-run declared list, frozen absorb suppression, file-type absorb round-trip, external dedup

Browse source
This commit is contained in:
Brian Majewski 2026-06-07 10:17:07 -07:00
parent ecc4f23494
commit 5489f89446
1 changed files with 76 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

76
test/manifest.bats
View file

@ -622,3 +622,79 @@ m_nojq_path() {
[[ "$output" == *"gradle.properties"* ]] || false [[ "$output" == *"gradle.properties"* ]] || false
[[ "$output" == *"k1"* ]] || false [[ "$output" == *"k1"* ]] || false
} }
# ─── F: ship Step 7 coverage backfill (audit gaps) ─────────────────────
@test "which flags an unsafe dotenv entry with the UNSAFE marker" {
create_project_dir whichunsafe
printf '{"version":2,"dotenv":[".env","../escape/.env"]}\n' > .secrets.json
run "$SECRETS_BIN" which
[ "$status" -eq 0 ]
[[ "$output" == *"UNSAFE"* ]] || false
[[ "$output" == *"will be refused"* ]] || false
}
@test "add to a malformed existing manifest dies with a directed error" {
create_project_dir addmalformed
echo '{ not json' > .secrets.json
run "$SECRETS_BIN" add .env
[ "$status" -eq 1 ]
[[ "$output" == *"invalid"* ]] || false
}
@test "push --dry-run lists declared entries under 'Would sync'" {
init_with_remote
create_project_dir drysync
"$SECRETS_BIN" add .env >/dev/null
run "$SECRETS_BIN" push --dry-run
[ "$status" -eq 0 ]
[[ "$output" == *"Would sync (declared)"* ]] || false
[[ "$output" == *".env"* ]] || false
}
@test "push --frozen does not absorb a legacy .secrets-files" {
init_with_remote
m_gradle_src $'beaconClerkPkTest=pk_test_abc\n'
local dir="$WORK_DIR/frozenabsorb"; mkdir -p "$dir"
echo "K=v" > "$dir/.env"
printf '{"version":2,"dotenv":[".env"]}\n' > "$dir/.secrets.json"
printf 'gradle-properties ~/.gradle/gradle.properties beaconClerkPkTest\n' > "$dir/.secrets-files"
cd "$dir"
run "$SECRETS_BIN" push --frozen frozenabsorb
[ "$status" -eq 0 ]
[[ "$output" != *"Absorbed"* ]] || false
run jq -r '.external // [] | length' .secrets.json
[ "$output" = "0" ]
}
@test "file entry absorbed from legacy round-trips on pull" {
init_with_remote
m_file_src
local dir="$WORK_DIR/fileabsorb"; mkdir -p "$dir"
echo "K=v" > "$dir/.env"
printf 'file ~/keystores/upload.keystore\n' > "$dir/.secrets-files"
cd "$dir"
"$SECRETS_BIN" push fileabsorb >/dev/null 2>&1
run jq -r '.external[] | select(.type=="file") | .path' .secrets.json
[ "$output" = "~/keystores/upload.keystore" ]
cp "$HOME/keystores/upload.keystore" "$TEST_TMPDIR/orig.ks"
rm "$HOME/keystores/upload.keystore"
rm -f .secrets-files
run "$SECRETS_BIN" pull fileabsorb
[ "$status" -eq 0 ]
cmp -s "$HOME/keystores/upload.keystore" "$TEST_TMPDIR/orig.ks"
}
@test "push dedups a legacy entry already present in the manifest external[]" {
init_with_remote
m_gradle_src $'beaconClerkPkTest=pk_test_abc\n'
local dir="$WORK_DIR/dedupext"; mkdir -p "$dir"
echo "K=v" > "$dir/.env"
printf '{"version":2,"dotenv":[".env"],"external":[{"type":"properties","path":"~/.gradle/gradle.properties","keys":["beaconClerkPkTest"]}]}\n' > "$dir/.secrets.json"
printf 'gradle-properties ~/.gradle/gradle.properties beaconClerkPkTest\n' > "$dir/.secrets-files"
cd "$dir"
run "$SECRETS_BIN" push dedupext
[ "$status" -eq 0 ]
run jq -r '.external | length' .secrets.json
[ "$output" = "1" ]
}