Skip to content

[DO NOT REVIEW] [SVLS-8660] test: gitleaks smoke test (DO NOT MERGE) #1142

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
litianningdatadog wants to merge 3 commits into
base: main
Choose a base branch
from
Draft

[DO NOT REVIEW] [SVLS-8660] test: gitleaks smoke test (DO NOT MERGE) #1142

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
c8ecead
test: gitleaks smoke test — intentional fake credential
litianningdatadog Mar 30, 2026
18d9930
test: use non-allowlisted fake credentials in gitleaks smoke test
litianningdatadog Mar 30, 2026
9bd81b9
test: fix fake AWS key length to exactly 20 chars for gitleaks match
litianningdatadog Mar 30, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 21 additions & 0 deletions integration-tests/gitleaks-smoke-test.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,21 @@
#!/bin/bash
# SMOKE TEST ONLY — do not merge to main
#
# This file exists solely to verify that the gitleaks Secrets Scan CI job
# correctly blocks PRs containing credential-shaped strings.
#
# After confirming the CI job fails on this branch, delete this file and
# remove this branch.
#
# See: .github/workflows/secrets-scan.yml
# See: PR #1134 test plan — "Optional smoke test" step

# Fake AWS access key that matches the AKIA[A-Z0-9]{16} pattern.
# NOT a real credential — generated for smoke-test purposes only.
# Deliberately avoids the canonical AWS doc examples (AKIAIOSFODNN7EXAMPLE)
# which are in gitleaks' internal global allowlist and would not be flagged.
FAKE_AWS_KEY="AKIAT3STFAKEKEY12345"
FAKE_AWS_SECRET="sM0keT3st+FaKeK3y/ABCDEFGHIJ1234567890ab"

echo "This file is intentionally flagged by gitleaks for smoke-test purposes."
echo "Key: $FAKE_AWS_KEY"
Copy link

Copilot AI Mar 30, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The echo statement on line 20 only prints the AWS key but not the AWS secret. Line 17 defines both FAKE_AWS_SECRET, but only FAKE_AWS_KEY is echoed. For consistency and to verify both credentials are detected by gitleaks, consider also echoing the secret value, or clarify if the secret is only being tested through the variable assignment itself.

Suggested change
echo "Key: $FAKE_AWS_KEY"
echo "Key: $FAKE_AWS_KEY"
echo "Secret: $FAKE_AWS_SECRET"

Copilot uses AI. Check for mistakes.
Loading