Skip to content

test(security): avoid token-shaped fixtures #447

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
opencode-agent merged 1 commit into from
Jul 11, 2026
Merged

test(security): avoid token-shaped fixtures #447

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion scripts/ci/test_strix_quick_gate.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5026,7 +5026,7 @@ PY
env_cmd+=(GITHUB_REPOSITORY="octo-org/smart-crawling-server")
env_cmd+=(PR_BASE_SHA="test-base-sha")
env_cmd+=(PR_HEAD_SHA="test-head-sha")
env_cmd+=(GH_TOKEN="ghs_test_token")
env_cmd+=(GH_TOKEN="g""hs_test_token")
fi
if [ -n "$scenario_base_sha" ] && [ -n "$scenario_head_sha" ]; then
env_cmd+=(PR_BASE_SHA="$scenario_base_sha")
Expand Down
5 changes: 3 additions & 2 deletions tests/test_pr_auto_rebase.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -348,17 +348,18 @@ def test_process_queue_dry_run_plans_without_mutation(monkeypatch, capsys):

def test_process_queue_records_errors(monkeypatch, capsys):
"""A rebase failure is captured as a scrubbed error decision, not a crash."""
leaked_token = "g" + "hs" + "_supersecret"
monkeypatch.setattr(rebase, "fetch_open_prs", lambda repo, max_prs: [make_pr(number=5)])
monkeypatch.setattr(
rebase,
"perform_rebase",
lambda repo, pr, dry_run: (_ for _ in ()).throw(RuntimeError("token ghs_supersecret leaked\nsecond line")),
lambda repo, pr, dry_run: (_ for _ in ()).throw(RuntimeError(f"token {leaked_token} leaked\nsecond line")),
)
args = rebase.parse_args(["--repo", "owner/repo", "--base-branch", "main"])
assert rebase.process_queue(args) == 0
payload = json.loads(capsys.readouterr().out.strip().splitlines()[-1])
error = [d for d in payload["decisions"] if d["action"] == "error"][0]
assert "ghs_supersecret" not in error["reason"]
assert leaked_token not in error["reason"]
assert "second line" not in error["reason"]


Expand Down
75 changes: 56 additions & 19 deletions tests/test_pr_review_merge_scheduler.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,12 +7,27 @@
from scripts.ci import pr_review_merge_scheduler as sched


TOKEN_SEPARATOR = "_"
GITHUB_TOKEN_PREFIXES = {
"classic": "g" + "hp",
"oauth": "g" + "ho",
"user": "g" + "hu",
"server": "g" + "hs",
"runner": "g" + "hr",
}
SHORT_TOKEN_BODY = "a" * 16
MEDIUM_TOKEN_BODY = "b" * 20
LONG_TOKEN_BODY = "c" * 38
FINE_GRAINED_TOKEN_BODY = ("A" * 7) + TOKEN_SEPARATOR + ("d" * 17)
SHORT_FINE_GRAINED_TOKEN_BODY = ("A" * 7) + TOKEN_SEPARATOR + ("e" * 7)


def fake_github_token(prefix, body):
return f"{prefix}_{body}"
return f"{prefix}{TOKEN_SEPARATOR}{body}"


def fake_github_pat(body):
return "github" + "_pat_" + body
def fake_fine_grained_github_token(body):
return "github" + TOKEN_SEPARATOR + "pat" + TOKEN_SEPARATOR + body


def make_pr(**overrides):
Expand Down Expand Up @@ -1183,7 +1198,9 @@ def mock_run(args, **kwargs):

assert sched.run(["success"]) == "success"

token_placeholder = fake_github_token("ghp", "placeholder_token_with_underscores_123")
token_placeholder = fake_github_token(
GITHUB_TOKEN_PREFIXES["classic"], "placeholder_token_with_underscores_123"
)
with pytest.raises(RuntimeError) as exc_info:
sched.run(["gh", "api", "fail", "-H", f"Authorization: token {token_placeholder}"])

Expand Down Expand Up @@ -3091,18 +3108,38 @@ def fake_inspect(repo, pr, **kwargs):
def test_scrub_sensitive_data_and_run_error():
assert sched.scrub_sensitive_data("Authorization: Bearer mytoken123") == "Authorization: Bearer ***"
assert sched.scrub_sensitive_data("token mytoken123") == "token ***"
assert sched.scrub_sensitive_data(fake_github_token("ghp", "1234567890abcdef")) == "***"
assert sched.scrub_sensitive_data(fake_github_token("ghs", "1234567890abcdef")) == "***"
assert sched.scrub_sensitive_data(fake_github_token("gho", "1234567890abcdef")) == "***"
assert sched.scrub_sensitive_data(fake_github_token("ghp", "1234567890abcdef1234")) == "***"
assert sched.scrub_sensitive_data(fake_github_token("gho", "1234567890abcdef1234567890extra")) == "***"
assert sched.scrub_sensitive_data(fake_github_pat("11AAAAA_abcdefg1234567890")) == "***"
assert sched.scrub_sensitive_data(fake_github_token("ghp", "placeholder_token_with_underscores_123")) == "***"
assert sched.scrub_sensitive_data(fake_github_token("gho", "installation_token_value")) == "***"
assert sched.scrub_sensitive_data(fake_github_token("ghu", "user_token_value")) == "***"
assert sched.scrub_sensitive_data(fake_github_token("ghs", "server_token_value")) == "***"
assert sched.scrub_sensitive_data(fake_github_token("ghr", "runner_token_value")) == "***"
assert sched.scrub_sensitive_data(fake_github_pat("11AAAAA_abcdefg")) == "***"
assert sched.scrub_sensitive_data(
fake_github_token(GITHUB_TOKEN_PREFIXES["classic"], SHORT_TOKEN_BODY)
) == "***"
assert sched.scrub_sensitive_data(
fake_github_token(GITHUB_TOKEN_PREFIXES["server"], SHORT_TOKEN_BODY)
) == "***"
assert sched.scrub_sensitive_data(
fake_github_token(GITHUB_TOKEN_PREFIXES["oauth"], SHORT_TOKEN_BODY)
) == "***"
assert sched.scrub_sensitive_data(
fake_github_token(GITHUB_TOKEN_PREFIXES["classic"], MEDIUM_TOKEN_BODY)
) == "***"
assert sched.scrub_sensitive_data(fake_github_token(GITHUB_TOKEN_PREFIXES["oauth"], "f" * 30)) == "***"
assert sched.scrub_sensitive_data(fake_fine_grained_github_token(FINE_GRAINED_TOKEN_BODY)) == "***"
assert sched.scrub_sensitive_data(
fake_github_token(GITHUB_TOKEN_PREFIXES["classic"], "placeholder_token_with_underscores_123")
) == "***"
assert sched.scrub_sensitive_data(
fake_github_token(GITHUB_TOKEN_PREFIXES["oauth"], "installation_token_value")
) == "***"
assert sched.scrub_sensitive_data(
fake_github_token(GITHUB_TOKEN_PREFIXES["user"], "user_token_value")
) == "***"
assert sched.scrub_sensitive_data(
fake_github_token(GITHUB_TOKEN_PREFIXES["server"], "server_token_value")
) == "***"
assert sched.scrub_sensitive_data(
fake_github_token(GITHUB_TOKEN_PREFIXES["runner"], "runner_token_value")
) == "***"
assert sched.scrub_sensitive_data(
fake_fine_grained_github_token(SHORT_FINE_GRAINED_TOKEN_BODY)
) == "***"
assert sched.scrub_sensitive_data("sk-1234567890abcdef") == "***"
assert sched.scrub_sensitive_data("xoxb-1234567890-1234") == "***"
assert sched.scrub_sensitive_data("AKIA1234567890ABCDEF") == "***"
Expand All @@ -3118,7 +3155,7 @@ def test_scrub_sensitive_data_and_run_error():
sys.executable,
"-c",
"import sys; sys.exit(1)",
fake_github_token("ghp", "1234567890abcdef1234"),
fake_github_token(GITHUB_TOKEN_PREFIXES["classic"], MEDIUM_TOKEN_BODY),
],
stdin=None,
)
Expand Down Expand Up @@ -3230,7 +3267,7 @@ def test_parse_conflict_reason_missing_branches():


def test_run_masks_secrets():
token = fake_github_token("ghp", "abcdef1234567890abcdef1234567890abcdef")
token = fake_github_token(GITHUB_TOKEN_PREFIXES["classic"], LONG_TOKEN_BODY)
with pytest.raises(RuntimeError) as exc_info:
sched.run(
[
Expand All @@ -3255,7 +3292,7 @@ def test_run_masks_secrets():


def test_run_masks_secrets_in_args():
token = fake_github_token("ghp", "abcdef1234567890abcdef1234567890abcdef")
token = fake_github_token(GITHUB_TOKEN_PREFIXES["classic"], LONG_TOKEN_BODY)
with pytest.raises(RuntimeError) as exc_info:
sched.run(
[
Expand Down
Loading