Read delivery tokens from files and check selected paths before release

internal/validation/untracked_files_test.go

@@ -0,0 +1,49 @@
+package validation
+
+import (
+	"context"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func TestUntrackedFilesUsesCapturedRepositoryPaths(t *testing.T) {
+	repository := newTreeRepository(t)
+	writeTreeFile(t, repository, "go.mod", []byte("module example.com/root\n"))
+	writeTreeFile(t, repository, "nested/go.mod", []byte("module example.com/nested\n"))
+	writeTreeFile(t, repository, "nested/token", []byte("fixture-secret\n"))
+	writeTreeFile(t, repository, ".gitignore", []byte(".releasekit/\n"))
+	gitTree(t, repository, "add", ".")
+	gitTree(t, repository, "commit", "-m", "capture a committed credential path")
+	commit := strings.TrimSpace(gitTree(t, repository, "rev-parse", "HEAD"))
+	writeTreeFile(t, repository, ".releasekit/token", []byte("local-secret\n"))
+	if err := os.Remove(filepath.Join(repository, "nested/token")); err != nil {
+		t.Fatal(err)
+	}
+
+	installGoShim(t, "", false)
+	request := Request{RepositoryDir: repository, Commit: commit}
+	if err := Run(context.Background(), request); err != nil {
+		t.Fatal(err)
+	}
+	request.Settings.UntrackedFiles = []string{".releasekit/token", "absent-token"}
+	if err := Run(context.Background(), request); err != nil {
+		t.Fatal(err)
+	}
+	request.Settings.UntrackedFiles = []string{"nested/./token"}
+	err := Run(context.Background(), request)
+	failure, ok := err.(*Failure)
+	if !ok || failure.Check != UntrackedFiles || len(failure.Findings) != 1 || failure.Findings[0].Path != "nested/token" {
+		t.Fatalf("untracked-files error = %v, want committed nested path despite worktree deletion", err)
+	}
+	if strings.Contains(err.Error(), "fixture-secret") {
+		t.Fatal("validation exposed committed token bytes")
+	}
+	for _, invalid := range []string{"", "../token", "/token"} {
+		request.Settings.UntrackedFiles = []string{invalid}
+		if err := Run(context.Background(), request); err == nil {
+			t.Fatalf("invalid path %q was accepted", invalid)
+		}
+	}
+}