Function Test_collectEnvCheckFindings

pkg/compose/publish_test.go:293–565

(t *testing.T)

}

func Test_collectEnvCheckFindings(t *testing.T) {
	tests := []struct {
		name            string
		files           map[string]string
		wantSuspicious  map[string][]string // service -> sorted suspicious keys
		wantEnvFile     []string            // services with env_file
		wantLiteralCfgs []string            // config names with literal content
	}{
		{
			name: "benign literals are silent",
			files: map[string]string{
				"compose.yaml": `name: test
services:
  web:
    image: alpine
    environment:
      LOG_LEVEL: info
      NODE_ENV: production
      PORT: "8080"
`,
			},
		},
		{
			name: "interpolated values are silent even on suspicious keys",
			files: map[string]string{
				"compose.yaml": `name: test
services:
  web:
    image: alpine
    environment:
      DB_PASSWORD: "${DB_PASSWORD}"
      API_KEY: "$API_KEY"
`,
			},
		},
		{
			name: "literal value on suspicious key is flagged",
			files: map[string]string{
				"compose.yaml": `name: test
services:
  db:
    image: mysql
    environment:
      MYSQL_ROOT_PASSWORD: toto
      MYSQL_DATABASE: appdb
`,
			},
			wantSuspicious: map[string][]string{
				"db": {"MYSQL_ROOT_PASSWORD"},
			},
		},
		{
			name: "demo placeholder changeme is flagged (security: literal still leaks)",
			files: map[string]string{
				"compose.yaml": `name: test
services:
  demo:
    image: postgres