Commit203e359

test(push-policy): mark fixture key line so push-time scanner skips it

test(push-policy): mark fixture key line so push-time scanner skips it

The scanner-regression test's own source contained a fake AWS key on a
line with no placeholder marker, so the (still-deployed old) secret scan
rejected the push of this very fix. Add a 'fake' marker to that source
line — the placeholder filter skips it — while the value still drives
detection inside the generated temp-repo fixtures.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

ccantynz-alt committed on July 24, 2026Parent: 76ee7bc

1 file changed+5−3203e359f0915307640c3b8db7530d85ff2ae03e6

1 changed file+5−3

Modifiedsrc/__tests__/push-policy-newbranch-scan.test.ts+5−3View fileUnified Split

@@ -19,9 +19,11 @@ import { tmpdir } from "os";

1919import { join } from "path";

2020import { installPackInspectionHook } from "../lib/push-policy";

2121

22// A fake-but-realistic AWS key that is NOT caught by the placeholder filter —

23// the kind of value a scanner-test fixture legitimately commits.

24const FIXTURE_SECRET = "AKIAABCDEFGH1234IJKL";

22// A realistic-looking AWS key SHAPE used only to drive the scanner in the

23// temp repo below. The `fake` marker on this line makes the push-time secret

24// scanner's placeholder filter skip THIS source line, while the value still

25// matches inside the generated fixture files (whose lines carry no marker).

26const FIXTURE_SECRET = "AKIAABCDEFGH1234IJKL"; // fake test credential, not real

2527

2628function git(cwd: string, args: string[], allowFail = false) {

2729 const proc = Bun.spawnSync(["git", ...args], {

2830