Read delivery tokens from files and check selected paths before release

token_validation_test.go

@@ -0,0 +1,38 @@
+package releasekit_test
+
+import (
+	"context"
+	"errors"
+	"testing"
+
+	releasekit "go.maximumdirect.net/releasekit"
+)
+
+func TestCommittedTokenFilePreventsCheckAndPublication(t *testing.T) {
+	for _, operation := range []string{"check", "publish"} {
+		t.Run(operation, func(t *testing.T) {
+			repo := newPublishFixture(t)
+			writeFile(t, repo.work, "local-token", "fixture-secret\n")
+			gitRun(t, repo.work, "add", "local-token")
+			gitRun(t, repo.work, "commit", "-m", "capture token path")
+			request := releasekit.ReleaseRequest{RepositoryDir: repo.work, Product: "Sample App", Version: "v1.2.3",
+				Validation: releasekit.ValidationSpec{UntrackedFiles: []string{"local-token"}},
+			}
+			var err error
+			if operation == "check" {
+				_, err = releasekit.Check(context.Background(), request)
+			} else {
+				gitRun(t, repo.work, "config", "--unset", "remote.origin.mirror")
+				gitRun(t, repo.work, "push", "origin", "HEAD:refs/heads/main")
+				_, err = releasekit.Publish(context.Background(), request)
+			}
+			var failure *releasekit.ValidationError
+			if !errors.As(err, &failure) || failure.Check != "untracked-files" || len(failure.Findings) != 1 || failure.Findings[0].Path != "local-token" {
+				t.Fatalf("operation error=%v, want public untracked-files diagnostic", err)
+			}
+			if gitText(t, repo.work, "tag", "--list", "v1.2.3") != "" {
+				t.Fatal("token-file validation created a release tag")
+			}
+		})
+	}
+}