SK-3015: Move dummy/fake test secrets into dummy-non-secrets folder - #422
Open
Devesh-Skyflow wants to merge 1 commit into
Open
SK-3015: Move dummy/fake test secrets into dummy-non-secrets folder#422Devesh-Skyflow wants to merge 1 commit into
Devesh-Skyflow wants to merge 1 commit into
Conversation
Gitleaks flagged 5 findings (generic-api-key x3, private-key x2) in test code for a shared dummy API key and fake PEM private keys. Per the ticket's ignorance strategy, dummy/fake secrets now live in resource files under a dummy-non-secrets/ folder (per module), which is excluded from Gitleaks scans via a new path allowlist entry in Rule/gitleaks.toml, instead of as string literals in the .java source. - common/src/test/resources/dummy-non-secrets/invalidTokenURICredentials.json (moved from src/test/resources/, reference in BearerTokenTests.java updated) - common/src/test/resources/dummy-non-secrets/invalidKeySpecCredentials.json (new; SignedDataTokensTests#testInvalidKeySpecInCredentials now loads it as a file instead of inlining the fake PEM key) - common/src/test/resources/dummy-non-secrets/dummy-api-key.txt and skyvault/src/test/resources/dummy-non-secrets/dummy-api-key.txt (new; CredentialsTests, ConnectionClientTests, and VaultClientTests now load the dummy API key from disk instead of hardcoding it) Scope limited to the 5 findings named in SK-3015; other pre-existing occurrences of the same dummy secrets elsewhere in the test suite are unchanged. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
|
✅ Gitleaks Findings: No secrets detected. Safe to proceed! |
|
Semgrep Findings: Issues with Error level severity are found (Error is Highest severity in Semgrep), Please resolve the issues before merging. |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #422 +/- ##
=======================================
Coverage 92.05% 92.05%
=======================================
Files 158 158
Lines 6631 6631
Branches 893 893
=======================================
Hits 6104 6104
Misses 349 349
Partials 178 178
Flags with carried forward coverage won't be shown. Click here to find out more.
Continue to review full report in Codecov by Harness.
🚀 New features to boost your workflow:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes SK-3015 — Gitleaks flagged 5 findings (3x
generic-api-key, 2xprivate-key) across the test suite for a shared dummy API key and fake PEM private keys.Per the ticket's stated ignorance strategy, dummy/fake secrets now live in resource files under a
dummy-non-secrets/folder (per module), excluded from Gitleaks scans via a new path allowlist entry inRule/gitleaks.toml, instead of as string literals/files directly in the scanned source tree.Changes
Rule/gitleaks.toml: addeddummy-non-secretsto the global path allowlist.common/src/test/resources/dummy-non-secrets/invalidTokenURICredentials.json— moved fromcommon/src/test/resources/(reference inBearerTokenTests.javaupdated accordingly).common/src/test/resources/dummy-non-secrets/invalidKeySpecCredentials.json— new;SignedDataTokensTests#testInvalidKeySpecInCredentialsnow loads it as a file instead of inlining the fake PEM key.common/src/test/resources/dummy-non-secrets/dummy-api-key.txtandskyvault/src/test/resources/dummy-non-secrets/dummy-api-key.txt— new;CredentialsTests,ConnectionClientTests, andVaultClientTestsnow read the dummy API key from disk instead of hardcoding it.Scope
Limited to the 5 findings named in the ticket. Other pre-existing occurrences of the same dummy secrets elsewhere in the test suite (already partly covered by existing
// gitleaks:allowcomments in some files) are left unchanged.Testing
mvn -pl common,skyvault -am test-compile— clean compile.mvn -pl common -am test -Dtest=CredentialsTests,SignedDataTokensTests,BearerTokenTests— all pass.mvn -pl skyvault -am test -Dtest=ConnectionClientTests,VaultClientTests— all pass.🤖 Generated with Claude Code