Skip to content

Commit c501e35

Browse files
MariusStorhaugMariusStorhaug
committed
🧪 [Test]: Prove TestSecrets plumbing with dedicated repo secrets
Self-tests now pass two dedicated, non-sensitive repository secrets (PSMODULE_TEST_SINGLELINE_SECRET, PSMODULE_TEST_MULTILINE_SECRET) through TestSecrets and assert the exact value and length (and multi-line integrity) in Environment.Tests.ps1. This exercises the real GitHub-secret path (masked, passed through, exposed as $env:<name>) instead of literal placeholders.
1 parent 93ca6f2 commit c501e35

4 files changed

Lines changed: 68 additions & 58 deletions

File tree

‎.github/workflows/Workflow-Test-Default.yml‎

Lines changed: 8 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -28,21 +28,16 @@ jobs:
2828
uses: ./.github/workflows/workflow.yml
2929
secrets:
3030
APIKey: ${{ secrets.APIKey }}
31-
# Self-test only: THROWAWAY, non-sensitive placeholder values (not real secrets), so the
32-
# framework's own tests never depend on repository secrets and masking can be verified with
33-
# known values. A real caller would use `toJSON(secrets.<name>)` for each entry instead.
34-
# The folded '>-' block with flat indentation produces a SINGLE-LINE secret value; a literal
35-
# '|' multi-line value makes GitHub register every line as its own mask and over-masks logs.
31+
# Self-test only: two dedicated, NON-SENSITIVE repository secrets (PSMODULE_TEST_*_SECRET) exist
32+
# purely to prove the TestSecrets plumbing end to end - a real GitHub secret is masked, passed
33+
# through, and exposed as $env:<name>. Their known values are asserted (value + length) in
34+
# tests/.../Environment.Tests.ps1.
35+
# The folded '>-' block keeps the JSON on a SINGLE line so GitHub registers one mask for the
36+
# blob; a multi-line blob makes every line (incl. braces) its own mask and over-masks the logs.
3637
TestSecrets: >-
3738
{
38-
"TEST_APP_ENT_CLIENT_ID": "tmp-ent-client-id-01",
39-
"TEST_APP_ENT_PRIVATE_KEY": "tmp-ent-key-a1\ntmp-ent-key-a2",
40-
"TEST_APP_ORG_CLIENT_ID": "tmp-org-client-id-02",
41-
"TEST_APP_ORG_PRIVATE_KEY": "tmp-org-key-b1\ntmp-org-key-b2",
42-
"TEST_USER_ORG_FG_PAT": "tmp-user-org-fgpat-03",
43-
"TEST_USER_USER_FG_PAT": "tmp-user-usr-fgpat-04",
44-
"TEST_USER_PAT": "tmp-user-pat-05",
45-
"CUSTOM_TEST_ENV_VAR": "caller-provided-value"
39+
"PSMODULE_TEST_SINGLELINE_SECRET": ${{ toJSON(secrets.PSMODULE_TEST_SINGLELINE_SECRET) }},
40+
"PSMODULE_TEST_MULTILINE_SECRET": ${{ toJSON(secrets.PSMODULE_TEST_MULTILINE_SECRET) }}
4641
}
4742
with:
4843
WorkingDirectory: tests/srcTestRepo

‎.github/workflows/Workflow-Test-WithManifest.yml‎

Lines changed: 8 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -28,21 +28,16 @@ jobs:
2828
uses: ./.github/workflows/workflow.yml
2929
secrets:
3030
APIKey: ${{ secrets.APIKey }}
31-
# Self-test only: THROWAWAY, non-sensitive placeholder values (not real secrets), so the
32-
# framework's own tests never depend on repository secrets and masking can be verified with
33-
# known values. A real caller would use `toJSON(secrets.<name>)` for each entry instead.
34-
# The folded '>-' block with flat indentation produces a SINGLE-LINE secret value; a literal
35-
# '|' multi-line value makes GitHub register every line as its own mask and over-masks logs.
31+
# Self-test only: two dedicated, NON-SENSITIVE repository secrets (PSMODULE_TEST_*_SECRET) exist
32+
# purely to prove the TestSecrets plumbing end to end - a real GitHub secret is masked, passed
33+
# through, and exposed as $env:<name>. Their known values are asserted (value + length) in
34+
# tests/.../Environment.Tests.ps1.
35+
# The folded '>-' block keeps the JSON on a SINGLE line so GitHub registers one mask for the
36+
# blob; a multi-line blob makes every line (incl. braces) its own mask and over-masks the logs.
3637
TestSecrets: >-
3738
{
38-
"TEST_APP_ENT_CLIENT_ID": "tmp-ent-client-id-01",
39-
"TEST_APP_ENT_PRIVATE_KEY": "tmp-ent-key-a1\ntmp-ent-key-a2",
40-
"TEST_APP_ORG_CLIENT_ID": "tmp-org-client-id-02",
41-
"TEST_APP_ORG_PRIVATE_KEY": "tmp-org-key-b1\ntmp-org-key-b2",
42-
"TEST_USER_ORG_FG_PAT": "tmp-user-org-fgpat-03",
43-
"TEST_USER_USER_FG_PAT": "tmp-user-usr-fgpat-04",
44-
"TEST_USER_PAT": "tmp-user-pat-05",
45-
"CUSTOM_TEST_ENV_VAR": "caller-provided-value"
39+
"PSMODULE_TEST_SINGLELINE_SECRET": ${{ toJSON(secrets.PSMODULE_TEST_SINGLELINE_SECRET) }},
40+
"PSMODULE_TEST_MULTILINE_SECRET": ${{ toJSON(secrets.PSMODULE_TEST_MULTILINE_SECRET) }}
4641
}
4742
with:
4843
WorkingDirectory: tests/srcWithManifestTestRepo

‎tests/srcTestRepo/tests/Environment.Tests.ps1‎

Lines changed: 26 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -1,20 +1,30 @@
1-
Describe 'Environment Variables are available' {
2-
It 'Exposes [<Name>] with the caller-provided value' -ForEach @(
3-
@{ Name = 'TEST_APP_ENT_CLIENT_ID'; Expected = 'tmp-ent-client-id-01' }
4-
@{ Name = 'TEST_APP_ORG_CLIENT_ID'; Expected = 'tmp-org-client-id-02' }
5-
@{ Name = 'TEST_USER_ORG_FG_PAT'; Expected = 'tmp-user-org-fgpat-03' }
6-
@{ Name = 'TEST_USER_USER_FG_PAT'; Expected = 'tmp-user-usr-fgpat-04' }
7-
@{ Name = 'TEST_USER_PAT'; Expected = 'tmp-user-pat-05' }
8-
@{ Name = 'CUSTOM_TEST_ENV_VAR'; Expected = 'caller-provided-value' }
9-
) {
10-
Write-Verbose "Environment variable: [$Name]" -Verbose
11-
[System.Environment]::GetEnvironmentVariable($Name) | Should -Be $Expected
1+
Describe 'TestSecrets are exposed to the module tests' {
2+
# PSMODULE_TEST_SINGLELINE_SECRET and PSMODULE_TEST_MULTILINE_SECRET are dedicated, non-sensitive
3+
# repository secrets that exist only to prove the TestSecrets plumbing. The calling workflow passes
4+
# them through TestSecrets and the framework exposes them as environment variables; these tests
5+
# confirm the values arrive present, complete and correct.
6+
7+
It 'Exposes the single-line secret with the exact expected value' {
8+
$expected = 'psmodule-public-nonsecret-test-fixture-single-line'
9+
$actual = [System.Environment]::GetEnvironmentVariable('PSMODULE_TEST_SINGLELINE_SECRET')
10+
$actual | Should -Not -BeNullOrEmpty
11+
$actual | Should -BeExactly $expected
12+
$actual.Length | Should -Be 50
1213
}
1314

14-
It 'Preserves multi-line values in [<Name>]' -ForEach @(
15-
@{ Name = 'TEST_APP_ENT_PRIVATE_KEY'; Expected = "tmp-ent-key-a1`ntmp-ent-key-a2" }
16-
@{ Name = 'TEST_APP_ORG_PRIVATE_KEY'; Expected = "tmp-org-key-b1`ntmp-org-key-b2" }
17-
) {
18-
[System.Environment]::GetEnvironmentVariable($Name) | Should -Be $Expected
15+
It 'Exposes the multi-line secret with every line intact' {
16+
$expected = @(
17+
'psmodule-public-nonsecret-test-fixture-line-1'
18+
'psmodule-public-nonsecret-test-fixture-line-2'
19+
'psmodule-public-nonsecret-test-fixture-line-3'
20+
) -join "`n"
21+
$actual = [System.Environment]::GetEnvironmentVariable('PSMODULE_TEST_MULTILINE_SECRET')
22+
$actual | Should -Not -BeNullOrEmpty
23+
$lines = $actual -split "`r?`n"
24+
$lines.Count | Should -Be 3
25+
$lines[0] | Should -BeExactly 'psmodule-public-nonsecret-test-fixture-line-1'
26+
$lines[2] | Should -BeExactly 'psmodule-public-nonsecret-test-fixture-line-3'
27+
($actual -replace "`r`n", "`n") | Should -BeExactly $expected
28+
($actual -replace "`r`n", "`n").Length | Should -Be 137
1929
}
2030
}

‎tests/srcWithManifestTestRepo/tests/Environments/Environment.Tests.ps1‎

Lines changed: 26 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -1,20 +1,30 @@
1-
Describe 'Environment Variables are available' {
2-
It 'Exposes [<Name>] with the caller-provided value' -ForEach @(
3-
@{ Name = 'TEST_APP_ENT_CLIENT_ID'; Expected = 'tmp-ent-client-id-01' }
4-
@{ Name = 'TEST_APP_ORG_CLIENT_ID'; Expected = 'tmp-org-client-id-02' }
5-
@{ Name = 'TEST_USER_ORG_FG_PAT'; Expected = 'tmp-user-org-fgpat-03' }
6-
@{ Name = 'TEST_USER_USER_FG_PAT'; Expected = 'tmp-user-usr-fgpat-04' }
7-
@{ Name = 'TEST_USER_PAT'; Expected = 'tmp-user-pat-05' }
8-
@{ Name = 'CUSTOM_TEST_ENV_VAR'; Expected = 'caller-provided-value' }
9-
) {
10-
Write-Verbose "Environment variable: [$Name]" -Verbose
11-
[System.Environment]::GetEnvironmentVariable($Name) | Should -Be $Expected
1+
Describe 'TestSecrets are exposed to the module tests' {
2+
# PSMODULE_TEST_SINGLELINE_SECRET and PSMODULE_TEST_MULTILINE_SECRET are dedicated, non-sensitive
3+
# repository secrets that exist only to prove the TestSecrets plumbing. The calling workflow passes
4+
# them through TestSecrets and the framework exposes them as environment variables; these tests
5+
# confirm the values arrive present, complete and correct.
6+
7+
It 'Exposes the single-line secret with the exact expected value' {
8+
$expected = 'psmodule-public-nonsecret-test-fixture-single-line'
9+
$actual = [System.Environment]::GetEnvironmentVariable('PSMODULE_TEST_SINGLELINE_SECRET')
10+
$actual | Should -Not -BeNullOrEmpty
11+
$actual | Should -BeExactly $expected
12+
$actual.Length | Should -Be 50
1213
}
1314

14-
It 'Preserves multi-line values in [<Name>]' -ForEach @(
15-
@{ Name = 'TEST_APP_ENT_PRIVATE_KEY'; Expected = "tmp-ent-key-a1`ntmp-ent-key-a2" }
16-
@{ Name = 'TEST_APP_ORG_PRIVATE_KEY'; Expected = "tmp-org-key-b1`ntmp-org-key-b2" }
17-
) {
18-
[System.Environment]::GetEnvironmentVariable($Name) | Should -Be $Expected
15+
It 'Exposes the multi-line secret with every line intact' {
16+
$expected = @(
17+
'psmodule-public-nonsecret-test-fixture-line-1'
18+
'psmodule-public-nonsecret-test-fixture-line-2'
19+
'psmodule-public-nonsecret-test-fixture-line-3'
20+
) -join "`n"
21+
$actual = [System.Environment]::GetEnvironmentVariable('PSMODULE_TEST_MULTILINE_SECRET')
22+
$actual | Should -Not -BeNullOrEmpty
23+
$lines = $actual -split "`r?`n"
24+
$lines.Count | Should -Be 3
25+
$lines[0] | Should -BeExactly 'psmodule-public-nonsecret-test-fixture-line-1'
26+
$lines[2] | Should -BeExactly 'psmodule-public-nonsecret-test-fixture-line-3'
27+
($actual -replace "`r`n", "`n") | Should -BeExactly $expected
28+
($actual -replace "`r`n", "`n").Length | Should -Be 137
1929
}
2030
}

0 commit comments

Comments
 (0)