Function TestClassifyStepSecrets

pkg/workflow/strict_mode_steps_validation_test.go:426–674

(t *testing.T)

}

func TestClassifyStepSecrets(t *testing.T) {
	tests := []struct {
		name               string
		step               any
		expectedUnsafe     []string
		expectedSafe       []string
		unorderedSafeMatch bool // use ElementsMatch instead of Equal for safe refs
	}{
		{
			name:           "non-map step classifies all as unsafe",
			step:           "echo ${{ secrets.TOKEN }}",
			expectedUnsafe: []string{"${{ secrets.TOKEN }}"},
			expectedSafe:   nil,
		},
		{
			name: "secret in run field is unsafe",
			step: map[string]any{
				"name": "Run step",
				"run":  "echo ${{ secrets.API_KEY }}",
			},
			expectedUnsafe: []string{"${{ secrets.API_KEY }}"},
			expectedSafe:   nil,
		},
		{
			name: "secret in env field is classified as safe",
			step: map[string]any{
				"name": "Env step",
				"env": map[string]any{
					"TOKEN": "${{ secrets.TOKEN }}",
				},
				"run": "echo hi",
			},
			expectedUnsafe: nil,
			expectedSafe:   []string{"${{ secrets.TOKEN }}"},
		},
		{
			name: "secrets in both env and run are classified separately",
			step: map[string]any{
				"name": "Mixed step",
				"env": map[string]any{
					"SAFE": "${{ secrets.SAFE }}",
				},
				"run": "curl ${{ secrets.LEAKED }}",
			},
			expectedUnsafe: []string{"${{ secrets.LEAKED }}"},
			expectedSafe:   []string{"${{ secrets.SAFE }}"},
		},
		{
			name: "secret in with field for uses action step is classified as safe",
			step: map[string]any{
				"uses": "some/action@v1",
				"with": map[string]any{
					"token": "${{ secrets.MY_TOKEN }}",
				},
			},
			expectedUnsafe: nil,
			expectedSafe:   []string{"${{ secrets.MY_TOKEN }}"},
		},