releasekit/token_validation_test.go

package releasekit_test

import (
	"context"
	"errors"
	"testing"

	releasekit "go.maximumdirect.net/releasekit"
)

func TestCommittedTokenFilePreventsCheckAndPublication(t *testing.T) {
	for _, operation := range []string{"check", "publish"} {
		t.Run(operation, func(t *testing.T) {
			repo := newPublishFixture(t)
			writeFile(t, repo.work, "local-token", "fixture-secret\n")
			gitRun(t, repo.work, "add", "local-token")
			gitRun(t, repo.work, "commit", "-m", "capture token path")
			request := releasekit.ReleaseRequest{RepositoryDir: repo.work, Product: "Sample App", Version: "v1.2.3",
				Validation: releasekit.ValidationSpec{ForbiddenFiles: []string{"local-token"}},
			}
			var err error
			if operation == "check" {
				_, err = releasekit.Check(context.Background(), request)
			} else {
				gitRun(t, repo.work, "config", "--unset", "remote.origin.mirror")
				gitRun(t, repo.work, "push", "origin", "HEAD:refs/heads/main")
				_, err = releasekit.Publish(context.Background(), request)
			}
			var failure *releasekit.ValidationError
			if !errors.As(err, &failure) || failure.Check != "forbidden-files" || len(failure.Findings) != 1 || failure.Findings[0].Path != "local-token" {
				t.Fatalf("operation error=%v, want public forbidden-files diagnostic", err)
			}
			if gitText(t, repo.work, "tag", "--list", "v1.2.3") != "" {
				t.Fatal("token-file validation created a release tag")
			}
		})
	}
}