Repository navigation
test: one shared invented credential so CodeQL stops re-flagging every test file #126
Description
Existing issue check
- I searched open and closed issues. None found.
Problem or outcome
CodeQL default setup (#123) flagged 42 alerts in integration tests on its first run. They break down as 29 rust/hard-coded-cryptographic-value and 13 rust/cleartext-logging. Each test file declares its own invented password, then signs in and prints the username. All 42 were dismissed as used in tests. But every new test file that copies the pattern raises the same alerts again and shows a failing CodeQL annotation on its PR. #98's new test file will be the next one.
Outcome
One shared test-credential helper owns the invented password: rung 1, one owning API. Test files use it instead of declaring their own. CodeQL then flags one location, dismissed once with a reason. The alternative is an advanced CodeQL setup that skips tests/. That is a broader blind spot, so it is the fallback, not the default.
Acceptance criteria
- No test file under
crates/consolebook-server/tests/declares its own password literal. A guard in the gates fails on a new one, with a negative control. - A CodeQL run on the PR raises no new alert in
tests/.
Related
#123 (comment 6196917174 has the triage).
Activity
TusanHomichi commentedon Oct 15, 2026
Recurred on #130 (2026-10-15), as predicted. The new
installation_exporttest files raisedrust/hard-coded-cryptographic-value(#52, a test password constant),rust/cleartext-logging(#50, a username in an assertion message), andrust/cleartext-storage-database(#51, the credential-absence test reading the fixture's credential columns as its positive control). All three were dismissed as used in tests, pointing here. Each one turned the PR'sCodeQLcheck red and opened a review thread that blocked merge until it was resolved by hand. That makes the rung-1 fix here worth doing soon.TusanHomichi commentedon Oct 15, 2026
Recurred again on #139 (2026-10-15):
tests/upgrade_compat.rsraisedrust/hard-coded-cryptographic-valuetwice (#53, #54), for an invented password and the argon2 v0.5 PHC fixture made from it. Both were dismissed as used in tests. That makes three PRs today (#130, #139) where this class turned CodeQL red and blocked merge until the threads were resolved by hand.TusanHomichi commentedon Oct 15, 2026
Selected (2026-10-15): the maintainer said "lets do 126 and 138 first", ahead of a 0.3.0 release. Work proceeds under the standing PR permission: an issue-linked branch, an independent review, the full local proof, then merge.
TusanHomichi commentedon Oct 15, 2026
Merged in #145 as
1dfb945604305a55e57c3218cba60b0c5d48e387, squashed onto the single parentb2949fd. The tree,78221af0, is identical to the proven headc19f940.54782768….fmt-clippy-test,build-x86_64andbuild-aarch64passed.upgrade_compat's run-time near miss of the allowlisted fixture. Both are dismissed as used in tests. Nothing new elsewhere intests/./data/dev/home/.codex/tmp/consolebook-126-138-20261015/.