Use placeholder identifiers in the URL validation tests - #29
Merged
Conversation
This test was written with a real company GUID, a real sandbox environment name, and a real custom-API publisher/group. This repo is public and domain-neutral by design; concrete tenant identifiers belong in the private overlay that consumes it, never here. Switched to the conventions the neighbouring URL tests already use — company "abc-123", publisher "contoso" — plus a placeholder GUID and generic entity names. The traversal payloads keep their shape, which is the only part that matters to what is being asserted. Worth noting for anyone auditing later: the wheel contains only the three packages, but the sdist ships the test tree, so a value left here would have been published inside an immutable PyPI artifact rather than only living in git.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Overview
Blocks the 0.7.0 PyPI release. The test added in #27 was written with a real
company GUID, a real sandbox environment name, and a real custom-API
publisher/group. This repo is public and domain-neutral by design — concrete tenant
identifiers belong in the private overlay that consumes it, never here.
They are identifiers rather than credentials (they appear in URLs and tokens, they
are not secrets), so this is a hygiene violation rather than an incident. But it
should not ship.
Why it matters more than "it's just a test file"
The wheel contains only
bcli,bcli_cli,bcli_mcp— but the sdist ships thetest tree (130 files). So publishing 0.7.0 as-is would bake the value into an
immutable, mirrored PyPI artifact, which is materially worse than it living in git
history. Verified by building locally and listing both artifacts.
Changes
Switched to the conventions the neighbouring URL tests already use — company
abc-123, publishercontoso— plus a placeholder GUID and generic entity names(
widgets,ledgerEntries,Microsoft.NAV.doThing). The traversal payloads keeptheir exact shape, which is the only part the assertions depend on.
Test plan
uv run pytest— 1075 passed, 5 skipped on top of currentmainuv run ruff check src tests— cleanv0.7.0after this merges