(t *testing.T)
| 364 | } |
| 365 | |
| 366 | func TestRunRedactsURLCredentials(t *testing.T) { |
| 367 | tempDir := setupTestRepository(t) |
| 368 | |
| 369 | // Fetch from an unreachable credential-embedded URL: both the args and git's stderr contain the URL. |
| 370 | _, err := Run(context.Background(), tempDir, "fetch", "https://user:secret-token@host.invalid/org/repo.git") |
| 371 | require.Error(t, err) |
| 372 | require.NotContains(t, err.Error(), "secret-token", "credentials must not leak into errors") |
| 373 | require.Contains(t, err.Error(), "<redacted>@") |
| 374 | } |
| 375 | |
| 376 | // setupRemoteAndClone creates a remote repository with a single commit on `main` |
| 377 | // and clones it into a separate local directory. It returns the remote and local paths. |
nothing calls this directly
no test coverage detected