Blame · Line-by-line history

`workflow-secrets-substitute.test.ts`

Each line is annotated with the commit that last touched it. Click any SHA to jump to that commit and see the surrounding change.

workflow-secrets-substitute.test.tsBlame113 lines · 1 contributor

Normal view Raw

18b210dClaude	1	/**
	2	* Pure-helper tests for src/lib/workflow-secrets.ts substituteSecrets.
	3	*
	4	* loadSecretsContext / upsert / delete are DB-coupled so they're not
	5	* exercised here — the crypto round-trip lives in
	6	* workflow-secrets-crypto.test.ts. This file pins the pure substitution
	7	* grammar so the runner's secret-injection contract can be relied on
	8	* without instantiating Postgres.
	9	*/
	10
	11	import { describe, it, expect } from "bun:test";
	12	import { substituteSecrets } from "../lib/workflow-secrets";
	13
	14	describe("substituteSecrets — happy path", () => {
	15	it("replaces a single token with the matching plaintext", () => {
	16	const out = substituteSecrets(
	17	'echo "$TOKEN_${{ secrets.TOKEN }}"',
	18	{ TOKEN: "abc123" }
	19	);
	20	expect(out).toBe('echo "$TOKEN_abc123"');
	21	});
	22
	23	it("replaces multiple tokens in one template", () => {
	24	const out = substituteSecrets(
	25	"DEPLOY_KEY=${{ secrets.DEPLOY_KEY }} REGION=${{ secrets.REGION }}",
	26	{ DEPLOY_KEY: "k1", REGION: "us-east-1" }
	27	);
	28	expect(out).toBe("DEPLOY_KEY=k1 REGION=us-east-1");
	29	});
	30
	31	it("tolerates whitespace variants inside the braces", () => {
	32	const map = { X: "v" };
	33	expect(substituteSecrets("${{secrets.X}}", map)).toBe("v");
	34	expect(substituteSecrets("${{ secrets.X }}", map)).toBe("v");
	35	expect(substituteSecrets("${{ secrets . X }}", map)).toBe("v");
	36	});
	37
	38	it("repeats substitution when a name appears multiple times", () => {
	39	const out = substituteSecrets(
	40	"${{ secrets.X }} and again ${{ secrets.X }}",
	41	{ X: "yes" }
	42	);
	43	expect(out).toBe("yes and again yes");
	44	});
	45	});
	46
	47	describe("substituteSecrets — leaves tokens intact when secret is missing", () => {
	48	it("missing name → token unchanged (loud failure signal)", () => {
	49	const tpl = "echo ${{ secrets.MISSING }}";
	50	expect(substituteSecrets(tpl, {})).toBe(tpl);
	51	expect(substituteSecrets(tpl, { OTHER: "x" })).toBe(tpl);
	52	});
	53
	54	it("substitutes the matching tokens and leaves the missing ones", () => {
	55	const out = substituteSecrets(
	56	"${{ secrets.A }} / ${{ secrets.B }} / ${{ secrets.C }}",
	57	{ A: "a", C: "c" }
	58	);
	59	expect(out).toBe("a / ${{ secrets.B }} / c");
	60	});
	61	});
	62
	63	describe("substituteSecrets — strict name grammar", () => {
	64	it("rejects lowercase names (matches GitHub Actions grammar)", () => {
	65	const tpl = "echo ${{ secrets.lower }}";
	66	expect(substituteSecrets(tpl, { lower: "x" })).toBe(tpl);
	67	});
	68
	69	it("rejects names starting with a digit", () => {
	70	const tpl = "echo ${{ secrets.1ABC }}";
	71	expect(substituteSecrets(tpl, { "1ABC": "x" })).toBe(tpl);
	72	});
	73
	74	it("accepts underscore-only names + names with digits", () => {
	75	expect(
	76	substituteSecrets("${{ secrets.A_B_C }}", { A_B_C: "v" })
	77	).toBe("v");
	78	expect(
	79	substituteSecrets("${{ secrets._UNDER }}", { _UNDER: "v" })
	80	).toBe("v");
	81	expect(
	82	substituteSecrets("${{ secrets.X1Y2 }}", { X1Y2: "v" })
	83	).toBe("v");
	84	});
	85	});
	86
	87	describe("substituteSecrets — defensive on bad input", () => {
	88	it("returns '' for non-string template", () => {
	89	expect(substituteSecrets(undefined as any, {})).toBe("");
	90	expect(substituteSecrets(null as any, {})).toBe("");
	91	expect(substituteSecrets(42 as any, {})).toBe("");
	92	});
	93
	94	it("returns the template untouched when secrets is null/undefined", () => {
	95	expect(substituteSecrets("hello", null as any)).toBe("hello");
	96	expect(substituteSecrets("hello", undefined as any)).toBe("hello");
	97	});
	98
	99	it("returns '' when both inputs are empty", () => {
	100	expect(substituteSecrets("", {})).toBe("");
	101	});
	102
	103	it("ignores prototype-pollution probes (uses hasOwnProperty)", () => {
	104	const tpl = "${{ secrets.TO_STRING }}";
	105	// {}.toString exists on the prototype; substitution must NOT pick it up.
	106	expect(substituteSecrets(tpl, {} as any)).toBe(tpl);
	107	});
	108
	109	it("does not alter unrelated `${{ ... }}` syntax (env, vars)", () => {
	110	const tpl = "${{ env.FOO }} ${{ vars.BAR }}";
	111	expect(substituteSecrets(tpl, { FOO: "v" })).toBe(tpl);
	112	});
	113	});