test(compile): add coverage for engine.provider base-url/resource validation

[github-actions]

Test Gap Fixes

Test suite snapshot: 2948 unit tests, 225 tests in compiler_tests.rs (up from 222), passing across the full cargo test run.

Added Coverage

Module	Function/Path	Why It Matters	Test Added
src/validate.rs	is_valid_provider_base_url — plaintext `(redacted) rejection	The provider endpoint receives the bearer token / API key, so only https:// literals or ADO $(VAR) macros are accepted; this scheme check previously had zero compile-level coverage (only the happy path was exercised)	test_provider_base_url_rejects_plaintext_http
src/validate.rs	is_valid_provider_resource_url — shell metacharacter rejection	provider.token.resource is shell-interpolated verbatim into the generated az account get-access-token --resource '(value)' mint step; an unvalidated value could break out of the quoted argument	test_provider_token_resource_rejects_shell_metacharacters
src/compile/types.rs (ProviderConfig)	macro base-url + non-default provider.token.resource override, compiled together	Both the macro-accepting branch of is_valid_provider_base_url and a custom resource override were previously completely untested	test_provider_base_url_macro_and_custom_resource_compile

These target the BYOK (engine.provider) validated-newtype surface in src/secure.rs/src/validate.rs, which handles values interpolated directly into generated shell/YAML and therefore is security-sensitive. Note: because ProviderConfig/ProviderToken sit inside the untagged EngineConfig enum, serde's rejection surfaces as a generic "Failed to parse YAML front matter" / "no variant matched" error rather than the newtype's specific message — the negative tests assert on that observed behavior.

Validation

• cargo test (2948 passed, 0 failed)
• cargo clippy --all-targets --all-features (clean)

Scope: only tests/compiler_tests.rs was modified; no production code changes.

---

This PR was created by the automated test gap finder. Modules audited this cycle: sanitize.rs, validate.rs, secure.rs (provider validation newtypes), fuzzy_schedule.rs, hash.rs.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• spsprodeus21.vssps.visualstudio.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "spsprodeus21.vssps.visualstudio.com"

See Network Configuration for more information.

Generated by Test Gap Finder · auto · 185.9 AIC · ⌖ 15.4 AIC · ⊞ 11.2K · ◷

[azure-pipelines]

Azure Pipelines:
2 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.