Blame · Line-by-line history

`push-policy-newbranch-scan.test.ts`

Each line is annotated with the commit that last touched it. Click any SHA to jump to that commit and see the surrounding change.

push-policy-newbranch-scan.test.tsBlame105 lines · 1 contributor

Normal view Raw

74202f0ccantynz-alt	1	/**
	2	* Regression: the pre-receive secret scan must inspect ONLY what a push
	3	* actually introduces — not the entire repo tree.
	4	*
	5	* The bug: for a NEW branch (oldSha = zero-SHA), buildPreReceiveScript() used
	6	* LOG_RANGE="$NEW" and a `git diff <empty-tree> $NEW`, which reports every
	7	* file in the whole repo as "changed". So pushing a clean feature branch was
	8	* rejected because a PRE-EXISTING committed test fixture (crafted to look like
	9	* a real secret, to test the scanner itself) matched a pattern — even though
	10	* the branch never touched it. This broke the documented
	11	* "push a feature branch → open a PR" workflow for every new branch.
	12	*
	13	* These tests drive the ACTUAL generated hook via a real `git push` into a
	14	* bare repo (same as production), rather than re-implementing the range logic.
	15	*/
	16	import { describe, expect, it, beforeAll } from "bun:test";
	17	import { mkdtempSync, writeFileSync } from "fs";
	18	import { tmpdir } from "os";
	19	import { join } from "path";
	20	import { installPackInspectionHook } from "../lib/push-policy";
	21
203e359ccantynz-alt	22	// A realistic-looking AWS key SHAPE used only to drive the scanner in the
	23	// temp repo below. The `fake` marker on this line makes the push-time secret
	24	// scanner's placeholder filter skip THIS source line, while the value still
	25	// matches inside the generated fixture files (whose lines carry no marker).
	26	const FIXTURE_SECRET = "AKIAABCDEFGH1234IJKL"; // fake test credential, not real
74202f0ccantynz-alt	27
	28	function git(cwd: string, args: string[], allowFail = false) {
	29	const proc = Bun.spawnSync(["git", ...args], {
	30	cwd,
	31	env: { ...process.env, GIT_TERMINAL_PROMPT: "0" },
	32	});
	33	const exitCode = proc.exitCode;
	34	const stderr = new TextDecoder().decode(proc.stderr);
	35	if (!allowFail && exitCode !== 0) {
	36	throw new Error(`git ${args.join(" ")} failed (${exitCode}):\n${stderr}`);
	37	}
	38	return { exitCode, stderr, stdout: new TextDecoder().decode(proc.stdout) };
	39	}
	40
	41	const GIT_OK = (() => {
	42	try {
	43	return Bun.spawnSync(["git", "--version"]).exitCode === 0;
	44	} catch {
	45	return false;
	46	}
	47	})();
	48
	49	describe.skipIf(!GIT_OK)("pre-receive scan only inspects pushed changes", () => {
	50	let bare: string;
	51	let work: string;
	52
	53	beforeAll(async () => {
	54	const root = mkdtempSync(join(tmpdir(), "gc-newbranch-"));
	55	bare = join(root, "bare.git");
	56	work = join(root, "work");
	57
	58	git(root, ["init", "--bare", "-b", "main", bare]);
	59	git(root, ["init", "-b", "main", work]);
	60	git(work, ["config", "user.email", "t@example.com"]);
	61	git(work, ["config", "user.name", "Test"]);
	62	git(work, ["config", "commit.gpgsign", "false"]);
	63
	64	// Seed main with a pre-existing fixture that CONTAINS a secret pattern,
	65	// pushed BEFORE the hook is installed (so it lands, exactly like the real
	66	// fixtures that predate the scanner).
	67	writeFileSync(join(work, "fixture.ts"), `const K = '${FIXTURE_SECRET}';\n`);
	68	git(work, ["add", "."]);
	69	git(work, ["commit", "-m", "seed fixture (has a secret pattern)"]);
	70	git(work, ["remote", "add", "origin", bare]);
	71	git(work, ["push", "-u", "origin", "main"]);
	72
	73	// Now arm the pre-receive hook on the bare repo.
	74	const hook = await installPackInspectionHook([], { secretScan: true });
	75	if (!hook) throw new Error("hook install returned null");
	76	git(bare, ["config", "core.hooksPath", hook.env.GIT_CONFIG_VALUE_0]);
	77	});
	78
	79	it("accepts a new branch that only adds a clean file (does NOT rescan the pre-existing fixture)", () => {
	80	git(work, ["checkout", "-b", "clean-feature", "main"]);
	81	writeFileSync(join(work, "clean.ts"), "export const ok = 1;\n");
	82	git(work, ["add", "clean.ts"]);
	83	git(work, ["commit", "-m", "add a clean file"]);
	84
	85	const res = git(work, ["push", "origin", "clean-feature"], true);
	86	// Before the fix this failed with "Secret scan: possible AWS Access Key
	87	// in fixture.ts" — a file the branch never touched.
	88	expect(res.stderr).not.toContain("Secret scan");
	89	expect(res.exitCode).toBe(0);
	90	});
	91
	92	it("still blocks a new branch that itself introduces a real secret", () => {
	93	git(work, ["checkout", "-b", "leaky-feature", "main"]);
	94	writeFileSync(join(work, "leak.ts"), `const K = '${FIXTURE_SECRET}';\n`);
	95	git(work, ["add", "leak.ts"]);
	96	git(work, ["commit", "-m", "oops committed a secret"]);
	97
	98	const res = git(work, ["push", "origin", "leaky-feature"], true);
	99	expect(res.exitCode).not.toBe(0);
	100	expect(res.stderr).toContain("Secret scan");
	101	expect(res.stderr).toContain("leak.ts");
	102	// And it must NOT also (falsely) flag the untouched fixture.
	103	expect(res.stderr).not.toContain("fixture.ts");
	104	});
	105	});