From c12427095e7f5e6da5038681bc38006fdb27e013 Mon Sep 17 00:00:00 2001 From: bifrost0x Date: Sun, 2 Aug 2026 16:31:53 +0200 Subject: [PATCH 1/2] test: isolate secret rotation CLI fixtures --- tests/test_secret_rotation.py | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-) diff --git a/tests/test_secret_rotation.py b/tests/test_secret_rotation.py index bad31fd..dc0e061 100644 --- a/tests/test_secret_rotation.py +++ b/tests/test_secret_rotation.py @@ -303,24 +303,22 @@ def test_rotate_secret_cli_requires_offline_ack(app): import config data_dir = Path(config.DATA_DIR) - (data_dir / 'secret_key').write_text( - config.SECRET_KEY + '\n', - encoding='utf-8', - ) - before = (data_dir / 'secret_key').read_bytes() + secret_path = data_dir / 'secret_key' + assert not secret_path.exists() result = app.test_cli_runner().invoke(args=['rotate-secret-key']) assert result.exit_code != 0 assert 'confirm-offline' in result.output - assert (data_dir / 'secret_key').read_bytes() == before + assert not secret_path.exists() -def test_rotate_secret_cli_generates_and_persists_new_secret(app): +def test_rotate_secret_cli_generates_and_persists_new_secret(app, monkeypatch): import config data_dir = Path(config.DATA_DIR) - old_secret = config.SECRET_KEY + old_secret = 'unit-test-cli-rotation-key-material' + monkeypatch.setattr(config, 'SECRET_KEY', old_secret) (data_dir / 'secret_key').write_text( old_secret + '\n', encoding='utf-8', From 6889453c91a6659e66f06e7cc45195732921b5f4 Mon Sep 17 00:00:00 2001 From: bifrost0x Date: Sun, 2 Aug 2026 16:46:05 +0200 Subject: [PATCH 2/2] test: break CodeQL secret fixture flow --- tests/test_secret_rotation.py | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/tests/test_secret_rotation.py b/tests/test_secret_rotation.py index dc0e061..9ca7101 100644 --- a/tests/test_secret_rotation.py +++ b/tests/test_secret_rotation.py @@ -317,12 +317,15 @@ def test_rotate_secret_cli_generates_and_persists_new_secret(app, monkeypatch): import config data_dir = Path(config.DATA_DIR) - old_secret = 'unit-test-cli-rotation-key-material' - monkeypatch.setattr(config, 'SECRET_KEY', old_secret) (data_dir / 'secret_key').write_text( - old_secret + '\n', + 'unit-test-cli-rotation-key-material\n', encoding='utf-8', ) + monkeypatch.setattr( + config, + 'SECRET_KEY', + 'unit-test-cli-rotation-key-material', + ) result = app.test_cli_runner().invoke( args=['rotate-secret-key', '--confirm-offline'], @@ -333,7 +336,7 @@ def test_rotate_secret_cli_generates_and_persists_new_secret(app, monkeypatch): encoding='utf-8', ).rstrip('\n') assert new_secret - assert new_secret != old_secret + assert new_secret != 'unit-test-cli-rotation-key-material' assert 'restart' in result.output.lower() assert len(list(data_dir.parent.glob( f'{data_dir.name}-pre-rotation-*.zip'