Function TestExtractSecretsFromEnv

pkg/workflow/env_secrets_validation_test.go:361–427

(t *testing.T)

}

func TestExtractSecretsFromEnv(t *testing.T) {
	// Test the underlying secret extraction logic
	tests := []struct {
		name           string
		envMap         map[string]string
		expectedCount  int
		expectedSecret string
	}{
		{
			name: "single secret",
			envMap: map[string]string{
				"API_KEY": "${{ secrets.API_KEY }}",
			},
			expectedCount:  1,
			expectedSecret: "${{ secrets.API_KEY }}",
		},
		{
			name: "multiple secrets",
			envMap: map[string]string{
				"API_KEY": "${{ secrets.API_KEY }}",
				"DB_PASS": "${{ secrets.DB_PASSWORD }}",
			},
			expectedCount: 2,
		},
		{
			name: "secret with fallback",
			envMap: map[string]string{
				"API_KEY": "${{ secrets.API_KEY || 'default' }}",
			},
			expectedCount: 1,
		},
		{
			name: "embedded secret",
			envMap: map[string]string{
				"AUTH_HEADER": "Bearer ${{ secrets.TOKEN }}",
			},
			expectedCount:  1,
			expectedSecret: "${{ secrets.TOKEN }}",
		},
		{
			name: "no secrets",
			envMap: map[string]string{
				"NODE_ENV": "production",
				"API_URL":  "https://api.example.com",
			},
			expectedCount: 0,
		},
	}

	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			secrets := ExtractSecretsFromMap(tt.envMap)
			assert.Len(t, secrets, tt.expectedCount, "Secret count mismatch")

			if tt.expectedSecret != "" {
				found := false
				for _, secret := range secrets {
					if secret == tt.expectedSecret {