test: lock in secret redaction from logs with static, mutation and deterministic probes (E00-S04-T03)

2026-08-30 03:52:55 +00:00
parent 6458013306
commit 60bd097b70
2 changed files with 675 additions and 0 deletions
@@ -197,6 +197,35 @@ jobs:
      - name: Run config startup error test suite
        run: node --test tests/config-startup-error.test.mjs

+  # E00-S04-T03: the static assertions of tests/config-log-redaction.test.mjs
+  # gate every PR — the suite locks in automatic secret redaction from logs
+  # (packages/config's redactConfig/redactText + the server's redacting
+  # logger: every log line is scrubbed of the config's secret values) with
+  # mutation probes, and the deterministic probes execute the issue's test
+  # plan ("log configuration and confirm secret values are redacted"):
+  # booting the committed server logs its resolved configuration with the
+  # secret values replaced by [REDACTED], and no secret value appears in the
+  # log output. The job installs the frozen workspace and builds the config
+  # and database-postgres packages because the probes boot the committed
+  # server which imports them.
+  config-log-redaction:
+    name: Secret redaction from logs (E00-S04-T03)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install Node.js 24
+        uses: actions/setup-node@v4
+        with:
+          node-version: '24'
+      - name: Enable pnpm (corepack, pinned to 11.23.0 via packageManager)
+        run: corepack enable
+      - name: Install dependencies (frozen lockfile)
+        run: pnpm install --frozen-lockfile
+      - name: Build the config and database-postgres packages (the probes boot the committed server which imports them)
+        run: pnpm --filter @personal-blog/config build && pnpm --filter @personal-blog/database-postgres build
+      - name: Run config log redaction test suite
+        run: node --test tests/config-log-redaction.test.mjs
+
  # E00-S04-T01: the static assertions of tests/config-schema.test.mjs gate
  # every PR — the suite locks in the TypeBox/Ajv configuration schema
  # (packages/config, golden-tuple pins @sinclair/typebox@0.34.52 +