From 49dac2babd9b4524cb00968962e1fa083cd84914 Mon Sep 17 00:00:00 2001 From: Vivswan Shah <58091053+Vivswan@users.noreply.github.com> Date: Mon, 21 Sep 2026 19:38:19 -0400 Subject: [PATCH] test(sections): drop the thin secret-family suites the scenarios already pin The agents, codespaces, and dependabot secrets suites pinned three facts per family through one shared helper: the label, noun, and route of the plan, the seal against the family's key, and the keep default with the delete under the knob. Five mutants of the shared factory and engine that redden those suites also fail the scenarios of all three families, so the scenarios own every fact. The shared helper in test/sections had no importer left, so it leaves in the same change. The thin files' stated reason, keeping the diff-aware CI selector mapped to the section, no longer holds: any file under a section directory selects it. --- .../agents_secrets/agents_secrets.test.ts | 13 --- .../codespaces_secrets.test.ts | 12 -- .../dependabot_secrets.test.ts | 12 -- test/sections/secret-family.ts | 107 ------------------ 4 files changed, 144 deletions(-) delete mode 100644 src/sections/agents_secrets/agents_secrets.test.ts delete mode 100644 src/sections/codespaces_secrets/codespaces_secrets.test.ts delete mode 100644 src/sections/dependabot_secrets/dependabot_secrets.test.ts delete mode 100644 test/sections/secret-family.ts diff --git a/src/sections/agents_secrets/agents_secrets.test.ts b/src/sections/agents_secrets/agents_secrets.test.ts deleted file mode 100644 index 7d4b326c..00000000 --- a/src/sections/agents_secrets/agents_secrets.test.ts +++ /dev/null @@ -1,13 +0,0 @@ -// The factory and engine behavior stays pinned by the actions_secrets suite over the same repoSecretsSection() factory; this file pins only this -// family's own facts. - -import { pinSecretFamily } from "../../../test/sections/secret-family.js"; -import { agentsSecretsSection } from "./index.js"; - -pinSecretFamily({ - section: agentsSecretsSection, - segment: "agents", - keyId: "agents-key", - noun: "Copilot agents secret", - secretName: "MCP_TOKEN", -}); diff --git a/src/sections/codespaces_secrets/codespaces_secrets.test.ts b/src/sections/codespaces_secrets/codespaces_secrets.test.ts deleted file mode 100644 index ddeaae0c..00000000 --- a/src/sections/codespaces_secrets/codespaces_secrets.test.ts +++ /dev/null @@ -1,12 +0,0 @@ -// This family's own facts only; the shared skeleton and the engine pins live in test/sections/. - -import { pinSecretFamily } from "../../../test/sections/secret-family.js"; -import { codespacesSecretsSection } from "./index.js"; - -pinSecretFamily({ - section: codespacesSecretsSection, - segment: "codespaces", - keyId: "cs-key", - noun: "Codespaces secret", - secretName: "DOTFILES_PAT", -}); diff --git a/src/sections/dependabot_secrets/dependabot_secrets.test.ts b/src/sections/dependabot_secrets/dependabot_secrets.test.ts deleted file mode 100644 index ce31d751..00000000 --- a/src/sections/dependabot_secrets/dependabot_secrets.test.ts +++ /dev/null @@ -1,12 +0,0 @@ -// This family's own facts only; the shared skeleton and the engine pins live in test/sections/. - -import { pinSecretFamily } from "../../../test/sections/secret-family.js"; -import { dependabotSecretsSection } from "./index.js"; - -pinSecretFamily({ - section: dependabotSecretsSection, - segment: "dependabot", - keyId: "dep-key", - noun: "Dependabot secret", - secretName: "REGISTRY_TOKEN", -}); diff --git a/test/sections/secret-family.ts b/test/sections/secret-family.ts deleted file mode 100644 index 3d679c42..00000000 --- a/test/sections/secret-family.ts +++ /dev/null @@ -1,107 +0,0 @@ -/** - * The shared pin for one sealed-secret family minted by repoSecretsSection(); each section directory keeps a thin test invoking this, so the - * diff-aware CI selector still maps the section's tests to its key. - */ - -import { describe, expect, test } from "bun:test"; -import { executePlan } from "../../src/engine/execute.js"; -import type { SectionInput, SectionModule } from "../../src/sections/contract/module.js"; -import { planContext } from "../../src/sections/contract/plan.js"; -import type { RepoSecretsKey } from "../../src/sections/shared/repo-secrets.js"; -import { - MOCK_SECRETS_PUBLIC_KEY, - mockSodiumReady, - unsealSecretValue, -} from "../e2e/mock/secrets.js"; -import { MockApi } from "../mock-api.js"; -import { REPO, unwrap } from "./section-run.js"; -import { validatedInput } from "./validated-input.js"; - -/** The facts one family owns; everything else is the shared factory's. */ -export interface SecretFamilyFacts { - section: SectionModule; - /** The path segment under /repos/{owner}/{repo} the family's routes use. */ - segment: string; - /** A distinctive key_id served by the family's public-key route. */ - keyId: string; - /** The output noun for notes ("Dependabot secret", ...). */ - noun: string; - /** A representative declared secret name for the create case. */ - secretName: string; -} - -function listOf(...names: string[]) { - return { - data: { - total_count: names.length, - secrets: names.map((name) => ({ - name, - created_at: "2020-01-15T00:00:00Z", - updated_at: "2020-01-15T00:00:00Z", - })), - }, - }; -} - -export function pinSecretFamily({ section, segment, keyId, noun, secretName }: SecretFamilyFacts) { - const LIST = `GET /repos/o/r/${segment}/secrets?per_page=100&page=1`; - const PUBLIC_KEY = `GET /repos/o/r/${segment}/secrets/public-key`; - const plan = async (api: MockApi, declared: SectionInput) => - unwrap( - await section.plan(planContext(section, api, REPO), validatedInput(section.key, declared)), - ); - - describe(section.key, () => { - test("the plan's drift and notes carry this section's label and noun; the PUT is planned under its route", async () => { - const api = new MockApi({ - [LIST]: listOf("LEGACY"), - [PUBLIC_KEY]: { data: { key_id: keyId, key: MOCK_SECRETS_PUBLIC_KEY } }, - }); - const result = await plan(api, [{ name: secretName, value: "$V" }]); - expect(result.ops.map((op) => [op.role, op.params, op.drift])).toEqual([ - [ - "put", - { secret_name: secretName }, - [ - `${section.key}[${secretName}]: missing - declared in the settings file but not on the repo; apply will create it`, - ], - ], - ]); - expect(result.notes.join("\n")).toContain(`${noun} "LEGACY" exists on the repo`); - expect(result.notes.join("\n")).toContain(`${noun} values cannot be read back`); - expect(api.mutations()).toEqual([]); - }); - - test("execution seals against this family's public key and PUTs its route", async () => { - await mockSodiumReady(); - const api = new MockApi({ - [LIST]: listOf(), - [PUBLIC_KEY]: { data: { key_id: keyId, key: MOCK_SECRETS_PUBLIC_KEY } }, - }).allowMutations(`PUT /repos/o/r/${segment}/secrets/${secretName}`); - const planned = await plan(api, [{ name: secretName, value: "$V" }]); - const execution = await executePlan(planned, section, api, REPO, { - resolveSecret: () => "family-plain", - }); - expect(execution).toEqual({ - status: "applied", - changes: [`created secret "${secretName}"`], - notes: [], - landed: 1, - }); - const put = api.mutations().find((c) => c.method === "PUT"); - expect(put?.path).toBe(`/repos/o/r/${segment}/secrets/${secretName}`); - const payload = put?.payload as { encrypted_value: string; key_id: string }; - expect(payload.key_id).toBe(keyId); - expect(unsealSecretValue(payload.encrypted_value)).toBe("family-plain"); - }); - - test("undeclared secrets are kept by default and deleted only under the knob", async () => { - expect(section.undeclaredDefault).toBe("keep"); - const api = new MockApi({ [LIST]: listOf("STALE") }); - const result = await plan(api, { _undeclared: "delete", entries: [] }); - expect(result.ops.map((op) => [op.role, op.params, op.change])).toEqual([ - ["remove", { secret_name: "STALE" }, 'DELETED undeclared secret "STALE"'], - ]); - }); - }); -}