🧪 [Test]: Use throwaway temp secret values in self-tests + temporary masking probe

MariusStorhaug · MariusStorhaug · commit e5dfca3db4bc · 2026-07-08T03:52:42.000+02:00
Self-tests no longer depend on real repository secrets; they pass known throwaway values through TestSecrets so masking can be verified conclusively. Adds a temporary MASKPROBE that will be removed after log verification.
diff --git a/.github/workflows/Workflow-Test-Default.yml b/.github/workflows/Workflow-Test-Default.yml
@@ -28,20 +28,20 @@ jobs:
     uses: ./.github/workflows/workflow.yml
     secrets:
       APIKey: ${{ secrets.APIKey }}
-      # The calling workflow chooses which secrets to expose to the test jobs. Names are
-      # caller-defined and read by the module's Pester tests via $env:<name>. CUSTOM_TEST_ENV_VAR
-      # is a plain literal that proves arbitrary, caller-defined names flow through end to end.
+      # Self-test only: THROWAWAY, non-sensitive placeholder values (not real secrets), so the
+      # framework's own tests never depend on repository secrets and masking can be verified with
+      # known values. A real caller would use `toJSON(secrets.<name>)` for each entry instead.
       # The folded '>-' block with flat indentation produces a SINGLE-LINE secret value; a literal
       # '|' multi-line value makes GitHub register every line as its own mask and over-masks logs.
       TestSecrets: >-
         {
-        "TEST_APP_ENT_CLIENT_ID": ${{ toJSON(secrets.TEST_APP_ENT_CLIENT_ID) }},
-        "TEST_APP_ENT_PRIVATE_KEY": ${{ toJSON(secrets.TEST_APP_ENT_PRIVATE_KEY) }},
-        "TEST_APP_ORG_CLIENT_ID": ${{ toJSON(secrets.TEST_APP_ORG_CLIENT_ID) }},
-        "TEST_APP_ORG_PRIVATE_KEY": ${{ toJSON(secrets.TEST_APP_ORG_PRIVATE_KEY) }},
-        "TEST_USER_ORG_FG_PAT": ${{ toJSON(secrets.TEST_USER_ORG_FG_PAT) }},
-        "TEST_USER_USER_FG_PAT": ${{ toJSON(secrets.TEST_USER_USER_FG_PAT) }},
-        "TEST_USER_PAT": ${{ toJSON(secrets.TEST_USER_PAT) }},
+        "TEST_APP_ENT_CLIENT_ID": "tmp-ent-client-id-01",
+        "TEST_APP_ENT_PRIVATE_KEY": "tmp-ent-key-a1\ntmp-ent-key-a2",
+        "TEST_APP_ORG_CLIENT_ID": "tmp-org-client-id-02",
+        "TEST_APP_ORG_PRIVATE_KEY": "tmp-org-key-b1\ntmp-org-key-b2",
+        "TEST_USER_ORG_FG_PAT": "tmp-user-org-fgpat-03",
+        "TEST_USER_USER_FG_PAT": "tmp-user-usr-fgpat-04",
+        "TEST_USER_PAT": "tmp-user-pat-05",
         "CUSTOM_TEST_ENV_VAR": "caller-provided-value"
         }
     with:
diff --git a/.github/workflows/Workflow-Test-WithManifest.yml b/.github/workflows/Workflow-Test-WithManifest.yml
@@ -28,20 +28,20 @@ jobs:
     uses: ./.github/workflows/workflow.yml
     secrets:
       APIKey: ${{ secrets.APIKey }}
-      # The calling workflow chooses which secrets to expose to the test jobs. Names are
-      # caller-defined and read by the module's Pester tests via $env:<name>. CUSTOM_TEST_ENV_VAR
-      # is a plain literal that proves arbitrary, caller-defined names flow through end to end.
+      # Self-test only: THROWAWAY, non-sensitive placeholder values (not real secrets), so the
+      # framework's own tests never depend on repository secrets and masking can be verified with
+      # known values. A real caller would use `toJSON(secrets.<name>)` for each entry instead.
       # The folded '>-' block with flat indentation produces a SINGLE-LINE secret value; a literal
       # '|' multi-line value makes GitHub register every line as its own mask and over-masks logs.
       TestSecrets: >-
         {
-        "TEST_APP_ENT_CLIENT_ID": ${{ toJSON(secrets.TEST_APP_ENT_CLIENT_ID) }},
-        "TEST_APP_ENT_PRIVATE_KEY": ${{ toJSON(secrets.TEST_APP_ENT_PRIVATE_KEY) }},
-        "TEST_APP_ORG_CLIENT_ID": ${{ toJSON(secrets.TEST_APP_ORG_CLIENT_ID) }},
-        "TEST_APP_ORG_PRIVATE_KEY": ${{ toJSON(secrets.TEST_APP_ORG_PRIVATE_KEY) }},
-        "TEST_USER_ORG_FG_PAT": ${{ toJSON(secrets.TEST_USER_ORG_FG_PAT) }},
-        "TEST_USER_USER_FG_PAT": ${{ toJSON(secrets.TEST_USER_USER_FG_PAT) }},
-        "TEST_USER_PAT": ${{ toJSON(secrets.TEST_USER_PAT) }},
+        "TEST_APP_ENT_CLIENT_ID": "tmp-ent-client-id-01",
+        "TEST_APP_ENT_PRIVATE_KEY": "tmp-ent-key-a1\ntmp-ent-key-a2",
+        "TEST_APP_ORG_CLIENT_ID": "tmp-org-client-id-02",
+        "TEST_APP_ORG_PRIVATE_KEY": "tmp-org-key-b1\ntmp-org-key-b2",
+        "TEST_USER_ORG_FG_PAT": "tmp-user-org-fgpat-03",
+        "TEST_USER_USER_FG_PAT": "tmp-user-usr-fgpat-04",
+        "TEST_USER_PAT": "tmp-user-pat-05",
         "CUSTOM_TEST_ENV_VAR": "caller-provided-value"
         }
     with:
diff --git a/tests/srcTestRepo/tests/Environment.Tests.ps1 b/tests/srcTestRepo/tests/Environment.Tests.ps1
@@ -1,22 +1,24 @@
-﻿Describe 'Environment Variables are available' {
-    It 'Should be available [<_>]' -ForEach @(
-        'TEST_APP_ENT_CLIENT_ID',
-        'TEST_APP_ENT_PRIVATE_KEY',
-        'TEST_APP_ORG_CLIENT_ID',
-        'TEST_APP_ORG_PRIVATE_KEY',
-        'TEST_USER_ORG_FG_PAT',
-        'TEST_USER_USER_FG_PAT',
-        'TEST_USER_PAT'
+﻿# TEMP masking probe (removed after verification): deliberately emits throwaway secret values so
+# the run logs can be inspected to confirm they render as *** (masked).
+Write-Verbose ("MASKPROBE TEST_USER_PAT=[{0}] CUSTOM_TEST_ENV_VAR=[{1}]" -f $env:TEST_USER_PAT, $env:CUSTOM_TEST_ENV_VAR) -Verbose
+
+Describe 'Environment Variables are available' {
+    It 'Exposes [<Name>] with the caller-provided value' -ForEach @(
+        @{ Name = 'TEST_APP_ENT_CLIENT_ID'; Expected = 'tmp-ent-client-id-01' }
+        @{ Name = 'TEST_APP_ORG_CLIENT_ID'; Expected = 'tmp-org-client-id-02' }
+        @{ Name = 'TEST_USER_ORG_FG_PAT'; Expected = 'tmp-user-org-fgpat-03' }
+        @{ Name = 'TEST_USER_USER_FG_PAT'; Expected = 'tmp-user-usr-fgpat-04' }
+        @{ Name = 'TEST_USER_PAT'; Expected = 'tmp-user-pat-05' }
+        @{ Name = 'CUSTOM_TEST_ENV_VAR'; Expected = 'caller-provided-value' }
     ) {
-        $name = $_
-        Write-Verbose "Environment variable: [$name]" -Verbose
-        Get-ChildItem env: | Where-Object { $_.Name -eq $name } | Should -Not -BeNullOrEmpty
+        Write-Verbose "Environment variable: [$Name]" -Verbose
+        [System.Environment]::GetEnvironmentVariable($Name) | Should -Be $Expected
     }
 
-    It 'Exposes caller-defined secret names with their values' {
-        # CUSTOM_TEST_ENV_VAR is provided by the calling workflow through the TestSecrets JSON object.
-        # It proves arbitrary, caller-defined names are plumbed through as environment variables that
-        # the tests read via $env:<name>, without relying on secrets: inherit.
-        $env:CUSTOM_TEST_ENV_VAR | Should -Be 'caller-provided-value'
+    It 'Preserves multi-line values in [<Name>]' -ForEach @(
+        @{ Name = 'TEST_APP_ENT_PRIVATE_KEY'; Expected = "tmp-ent-key-a1`ntmp-ent-key-a2" }
+        @{ Name = 'TEST_APP_ORG_PRIVATE_KEY'; Expected = "tmp-org-key-b1`ntmp-org-key-b2" }
+    ) {
+        [System.Environment]::GetEnvironmentVariable($Name) | Should -Be $Expected
     }
 }
diff --git a/tests/srcWithManifestTestRepo/tests/Environments/Environment.Tests.ps1 b/tests/srcWithManifestTestRepo/tests/Environments/Environment.Tests.ps1
@@ -1,22 +1,24 @@
-﻿Describe 'Environment Variables are available' {
-    It 'Should be available [<_>]' -ForEach @(
-        'TEST_APP_ENT_CLIENT_ID',
-        'TEST_APP_ENT_PRIVATE_KEY',
-        'TEST_APP_ORG_CLIENT_ID',
-        'TEST_APP_ORG_PRIVATE_KEY',
-        'TEST_USER_ORG_FG_PAT',
-        'TEST_USER_USER_FG_PAT',
-        'TEST_USER_PAT'
+﻿# TEMP masking probe (removed after verification): deliberately emits throwaway secret values so
+# the run logs can be inspected to confirm they render as *** (masked).
+Write-Verbose ("MASKPROBE TEST_USER_PAT=[{0}] CUSTOM_TEST_ENV_VAR=[{1}]" -f $env:TEST_USER_PAT, $env:CUSTOM_TEST_ENV_VAR) -Verbose
+
+Describe 'Environment Variables are available' {
+    It 'Exposes [<Name>] with the caller-provided value' -ForEach @(
+        @{ Name = 'TEST_APP_ENT_CLIENT_ID'; Expected = 'tmp-ent-client-id-01' }
+        @{ Name = 'TEST_APP_ORG_CLIENT_ID'; Expected = 'tmp-org-client-id-02' }
+        @{ Name = 'TEST_USER_ORG_FG_PAT'; Expected = 'tmp-user-org-fgpat-03' }
+        @{ Name = 'TEST_USER_USER_FG_PAT'; Expected = 'tmp-user-usr-fgpat-04' }
+        @{ Name = 'TEST_USER_PAT'; Expected = 'tmp-user-pat-05' }
+        @{ Name = 'CUSTOM_TEST_ENV_VAR'; Expected = 'caller-provided-value' }
     ) {
-        $name = $_
-        Write-Verbose "Environment variable: [$name]" -Verbose
-        Get-ChildItem env: | Where-Object { $_.Name -eq $name } | Should -Not -BeNullOrEmpty
+        Write-Verbose "Environment variable: [$Name]" -Verbose
+        [System.Environment]::GetEnvironmentVariable($Name) | Should -Be $Expected
     }
 
-    It 'Exposes caller-defined secret names with their values' {
-        # CUSTOM_TEST_ENV_VAR is provided by the calling workflow through the TestSecrets JSON object.
-        # It proves arbitrary, caller-defined names are plumbed through as environment variables that
-        # the tests read via $env:<name>, without relying on secrets: inherit.
-        $env:CUSTOM_TEST_ENV_VAR | Should -Be 'caller-provided-value'
+    It 'Preserves multi-line values in [<Name>]' -ForEach @(
+        @{ Name = 'TEST_APP_ENT_PRIVATE_KEY'; Expected = "tmp-ent-key-a1`ntmp-ent-key-a2" }
+        @{ Name = 'TEST_APP_ORG_PRIVATE_KEY'; Expected = "tmp-org-key-b1`ntmp-org-key-b2" }
+    ) {
+        [System.Environment]::GetEnvironmentVariable($Name) | Should -Be $Expected
     }
 }
