Function TestEngineEnvSecretsCodemod

pkg/cli/codemod_engine_env_secrets_test.go:12–180

(t *testing.T)

)

func TestEngineEnvSecretsCodemod(t *testing.T) {
	codemod := getEngineEnvSecretsCodemod()

	t.Run("removes unsafe secret-bearing engine env keys and keeps allowed override", func(t *testing.T) {
		content := `---
on: workflow_dispatch
engine:
  id: codex
  env:
    OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
    OPENAI_BASE_URL: ${{ secrets.AZURE_OPENAI_ENDPOINT }}openai/v1
---
`
		frontmatter := map[string]any{
			"on": "workflow_dispatch",
			"engine": map[string]any{
				"id": "codex",
				"env": map[string]any{
					"OPENAI_API_KEY":  "${{ secrets.OPENAI_API_KEY }}",
					"OPENAI_BASE_URL": "${{ secrets.AZURE_OPENAI_ENDPOINT }}openai/v1",
				},
			},
		}

		result, applied, err := codemod.Apply(content, frontmatter)
		require.NoError(t, err, "codemod should apply cleanly")
		assert.True(t, applied, "codemod should apply")
		assert.Contains(t, result, "OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}", "allowed engine secret override should remain")
		assert.NotContains(t, result, "OPENAI_BASE_URL: ${{ secrets.AZURE_OPENAI_ENDPOINT }}openai/v1", "unsafe engine env secret should be removed")
	})

	t.Run("removes empty env block after deleting unsafe entries", func(t *testing.T) {
		content := `---
on: workflow_dispatch
engine:
  id: codex
  env:
    OPENAI_BASE_URL: ${{ secrets.AZURE_OPENAI_ENDPOINT }}openai/v1
---
`
		frontmatter := map[string]any{
			"on": "workflow_dispatch",
			"engine": map[string]any{
				"id": "codex",
				"env": map[string]any{
					"OPENAI_BASE_URL": "${{ secrets.AZURE_OPENAI_ENDPOINT }}openai/v1",
				},
			},
		}

		result, applied, err := codemod.Apply(content, frontmatter)
		require.NoError(t, err, "codemod should apply cleanly")
		assert.True(t, applied, "codemod should apply")
		assert.NotContains(t, result, "\n  env:\n", "empty env block should be removed")
		assert.Contains(t, result, "id: codex", "engine block should remain")
	})

	t.Run("no-op when only allowed engine secret override is used", func(t *testing.T) {