os-backlog tests run with the real FORGEJO_TOKEN and GITHUB_TOKEN #1728

New issue

Closed

opened 2026-11-12 21:33:59 +00:00 by jared · 1 comment

jared commented

2026-11-12 21:33:59 +00:00

Owner

Problem

The os-backlog test process inherits the real FORGEJO_TOKEN and GITHUB_TOKEN from ENV. Backlog::Host::Forgejo.new and Backlog::Host::GitHub.new default to env: ENV. They build a real client when client: is nil. When a defect drops the test client, a test builds a real authenticated client.
WebMock now blocks the request (commit 2cd91dd8d). But WebMock::NetConnectNotAllowedError prints the request headers. So the real token values appear in the test output.
Observed on 2026-11-12: a hand run of the suite with line 26 of lib/backlog/project.rb removed printed Authorization: token ... with the real values.

Reproduce

Remove line 26 of plugins/os-backlog/lib/backlog/project.rb (@connection = context.except(:state_dir, :git)). Run the os-backlog suite. Read the output of the failing tests.
Do not copy any token value from the output.

Approach

Leave open which fix to use: the tests give the hosts a fake env, or the test helper starts with fake token values.

Required work: none beyond the acceptance criteria.

Acceptance criteria

Given a test run where a defect drops the test client, when a host builds a client, then the token in any output is not a real token.

Origin

Trigger: os-sdlc-mutation-pass run plugins/os-backlog (pass 2, 2026-11-12)
Improvised this session: none
Chain: real tokens in test output ← tests inherit ENV ← hosts default to env: ENV; ends DESIGN: plugins/os-backlog/lib/backlog/host/forgejo.rb
Root candidate: none found; searched FORGEJO_TOKEN, GITHUB_TOKEN, env: ENV, token, #1071
Where: plugins/os-backlog/lib/backlog/host/forgejo.rb, plugins/os-backlog/lib/backlog/host/github.rb, plugins/os-backlog/test/test_helper.rb
Session: 4adfe731-519b-4fcb-a42b-a669ca766c4a
Transcript: /home/jared/.claude/projects/-home-jared-dev-cc-os-plugins-os-sdlc/4adfe731-519b-4fcb-a42b-a669ca766c4a.jsonl

VERDICT: CREATE (ticket-skeptic, 2026-11-12): no open ticket covers this work.

## Problem The os-backlog test process inherits the real `FORGEJO_TOKEN` and `GITHUB_TOKEN` from `ENV`. `Backlog::Host::Forgejo.new` and `Backlog::Host::GitHub.new` default to `env: ENV`. They build a real client when `client:` is nil. When a defect drops the test client, a test builds a real authenticated client. WebMock now blocks the request (commit 2cd91dd8d). But `WebMock::NetConnectNotAllowedError` prints the request headers. So the real token values appear in the test output. Observed on 2026-11-12: a hand run of the suite with line 26 of `lib/backlog/project.rb` removed printed `Authorization: token ...` with the real values. ## Reproduce Remove line 26 of `plugins/os-backlog/lib/backlog/project.rb` (`@connection = context.except(:state_dir, :git)`). Run the os-backlog suite. Read the output of the failing tests. Do not copy any token value from the output. ## Approach Leave open which fix to use: the tests give the hosts a fake env, or the test helper starts with fake token values. Required work: none beyond the acceptance criteria. ## Acceptance criteria 1. Given a test run where a defect drops the test client, when a host builds a client, then the token in any output is not a real token. ## Origin - Trigger: os-sdlc-mutation-pass run plugins/os-backlog (pass 2, 2026-11-12) - Improvised this session: none - Chain: real tokens in test output ← tests inherit ENV ← hosts default to env: ENV; ends DESIGN: plugins/os-backlog/lib/backlog/host/forgejo.rb - Root candidate: none found; searched FORGEJO_TOKEN, GITHUB_TOKEN, env: ENV, token, #1071 - Where: plugins/os-backlog/lib/backlog/host/forgejo.rb, plugins/os-backlog/lib/backlog/host/github.rb, plugins/os-backlog/test/test_helper.rb - Session: 4adfe731-519b-4fcb-a42b-a669ca766c4a - Transcript: /home/jared/.claude/projects/-home-jared-dev-cc-os-plugins-os-sdlc/4adfe731-519b-4fcb-a42b-a669ca766c4a.jsonl VERDICT: CREATE (ticket-skeptic, 2026-11-12): no open ticket covers this work.

jared added the

plugin/os-backlog

filed-by/user

category/code-change

labels

2026-11-12 21:33:59 +00:00

jared referenced this issue from a commit

2026-11-13 21:52:39 +00:00

fix(os-backlog): hosts default to an empty env, so tests never read the real tokens (#1728)

jared commented

2026-11-13 21:52:43 +00:00

Author

Owner

Resolution

Done: Backlog::Host::Forgejo and Backlog::Host::GitHub now default to env: {} instead of env: ENV. Library code never reads ENV; the bin/ scripts pass env: ENV as before.

Evidence: main 4e89450c7. Reproduction (project.rb:26 removed) with fake sentinel tokens in ENV: sentinels in 155 output lines before the fix, 0 after; 0 Authorization lines. Full suite 820 runs, 0 failures.

Follow-ups: none

## Resolution **Done:** Backlog::Host::Forgejo and Backlog::Host::GitHub now default to env: {} instead of env: ENV. Library code never reads ENV; the bin/ scripts pass env: ENV as before. **Evidence:** main 4e89450c7. Reproduction (project.rb:26 removed) with fake sentinel tokens in ENV: sentinels in 155 output lines before the fix, 0 after; 0 Authorization lines. Full suite 820 runs, 0 failures. **Follow-ups:** none

jared closed this issue

2026-11-13 21:52:43 +00:00