Defame1297
6c8ea8e8f0
The previous commit only landed the research-folder rename — a multi-path git add silently failed and left CONTEXT.md, ADR-0012, and the actual skill files unstaged. This lands them: the agentsmd-audit skill itself (three deterministic validators for secrets, structure, and drift against a target repo's AGENTS.md), its bats test suite, provenance record, and the CONTEXT.md/ADR entries documenting why this lives in core rather than kyberforge. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
69 lines
1.8 KiB
Bash
69 lines
1.8 KiB
Bash
#!/usr/bin/env bats
|
|
|
|
setup() {
|
|
REPO_ROOT="$(cd "$BATS_TEST_DIRNAME/../../../../../" && pwd)"
|
|
load "$REPO_ROOT/tests/test_helper/bats-support/load"
|
|
load "$REPO_ROOT/tests/test_helper/bats-assert/load"
|
|
|
|
SCRIPT="$(cd "$BATS_TEST_DIRNAME/../scripts" && pwd)/validate-secrets.sh"
|
|
TMPDIR="$(mktemp -d)"
|
|
}
|
|
|
|
teardown() {
|
|
rm -rf "$TMPDIR"
|
|
}
|
|
|
|
@test "passes on AGENTS.md with no secrets, only placeholders" {
|
|
cat > "$TMPDIR/AGENTS.md" <<'EOF'
|
|
# AGENTS.md
|
|
|
|
## Setup
|
|
- Set `export API_KEY=$API_KEY`
|
|
- Token: <your-token-here>
|
|
- DB: postgres://user:changeme@localhost/db
|
|
EOF
|
|
run bash "$SCRIPT" "$TMPDIR"
|
|
assert_success
|
|
assert_output ""
|
|
}
|
|
|
|
@test "fails on a real-looking AWS access key" {
|
|
cat > "$TMPDIR/AGENTS.md" <<'EOF'
|
|
# AGENTS.md
|
|
|
|
## Setup
|
|
- AWS_ACCESS_KEY_ID=AKIAABCDEFGHIJKLMNOP # gitleaks:allow (synthetic fixture — this test verifies validate-secrets.sh catches exactly this pattern)
|
|
EOF
|
|
run bash "$SCRIPT" "$TMPDIR"
|
|
assert_failure
|
|
assert_output --partial "AWS access key ID"
|
|
assert_output --partial "AGENTS.md:4"
|
|
}
|
|
|
|
@test "fails on a credential-bearing connection string" {
|
|
cat > "$TMPDIR/AGENTS.md" <<'EOF'
|
|
# AGENTS.md
|
|
|
|
## Setup
|
|
- DB: postgres://svc_user:h8x2Klm9pQrT@db.internal:5432/prod
|
|
EOF
|
|
run bash "$SCRIPT" "$TMPDIR"
|
|
assert_failure
|
|
assert_output --partial "connection string"
|
|
}
|
|
|
|
@test "detects secrets in a nested AGENTS.md, not just root" {
|
|
mkdir -p "$TMPDIR/packages/api"
|
|
cat > "$TMPDIR/AGENTS.md" <<'EOF'
|
|
# AGENTS.md
|
|
Clean root file.
|
|
EOF
|
|
cat > "$TMPDIR/packages/api/AGENTS.md" <<'EOF'
|
|
# API package
|
|
- token: ghp_1234567890abcdefghijklmnopqrstuvwxyz01 # gitleaks:allow (synthetic fixture)
|
|
EOF
|
|
run bash "$SCRIPT" "$TMPDIR"
|
|
assert_failure
|
|
assert_output --partial "packages/api/AGENTS.md"
|
|
}
|