From 2641199e6d4d6eb56e00176901baf82244b97beb Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Tue, 21 Jul 2026 16:27:43 +0100
Subject: [PATCH] ci: mark deliberate secret-shaped test fixtures for
 rust-secrets
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

standards' `rust-secrets` job becomes blocking outside `./src` on
2026-08-21. The lines tagged here are genuine matches on genuine
secret-shaped literals — they are test data, not credentials — so they take
the explicit per-line pragma rather than a pattern loophole that would weaken
the gate for every repo.

These are this repo's OWN secret-detection fixtures. Every pragma sits
OUTSIDE the r#"…"# raw string (after the closing quote / comma), so it is an
ordinary Rust comment and the fixture content is byte-identical — the tests
exercise exactly the same data as before.

Verified: `rust-secrets` (extracted from standards' shipping YAML) exits 0 on
this tree with RUST_TODAY=2026-09-01, i.e. after the cutoff.

Scope: this commit touches ONLY Rust sources. The secret-scanner re-pin is
deliberately NOT bundled — this repo is one of the 22 the sweep flagged, where
gitleaks findings survive the estate baseline, and switching it to the real
gate needs its own triage.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 benches/oracle_bench.rs       | 2 +-
 src/contract/src/lib.rs       | 2 +-
 src/oracle/src/lib.rs         | 6 +++---
 tests/gating_pipeline_test.rs | 2 +-
 tests/security_aspect_test.rs | 2 +-
 5 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/benches/oracle_bench.rs b/benches/oracle_bench.rs
index a862526..f35f65d 100644
--- a/benches/oracle_bench.rs
+++ b/benches/oracle_bench.rs
@@ -66,7 +66,7 @@ fn secret_proposal() -> Proposal {
         action_type: ActionType::CreateFile {
             path: "src/config.rs".to_string(),
         },
-        content: r#"let api_key = "supersecretkey12345""#.to_string(),
+        content: r#"let api_key = "supersecretkey12345""#.to_string(),  // scanner-allow: rust-secrets
         files_affected: vec!["src/config.rs".to_string()],
         llm_confidence: 0.9,
     }
diff --git a/src/contract/src/lib.rs b/src/contract/src/lib.rs
index c56ad04..7a886f0 100644
--- a/src/contract/src/lib.rs
+++ b/src/contract/src/lib.rs
@@ -1565,7 +1565,7 @@ mod tests {
         let runner = ContractRunner::new();
         let request = GatingRequest::new(create_proposal(
             "config.rs",
-            r#"let password = "supersecret123456""#,
+            r#"let password = "supersecret123456""#,  // scanner-allow: rust-secrets
         ));
 
         let decision = runner.evaluate(&request).unwrap();
diff --git a/src/oracle/src/lib.rs b/src/oracle/src/lib.rs
index b755061..6a916e6 100644
--- a/src/oracle/src/lib.rs
+++ b/src/oracle/src/lib.rs
@@ -729,7 +729,7 @@ mod tests {
             action_type: ActionType::CreateFile {
                 path: "config.rs".to_string(),
             },
-            content: r#"let password = "supersecretpassword123""#.to_string(), // test fixture
+            content: r#"let password = "supersecretpassword123""#.to_string(), // test fixture — scanner-allow: rust-secrets
             files_affected: vec!["config.rs".to_string()],
             llm_confidence: 0.9,
         };
@@ -766,7 +766,7 @@ mod tests {
             action_type: ActionType::CreateFile {
                 path: "main.ts".to_string(),
             },
-            content: r#"const x: string = 'hello'; let password = "secret123""#.to_string(),
+            content: r#"const x: string = 'hello'; let password = "secret123""#.to_string(),  // scanner-allow: rust-secrets
             files_affected: vec!["main.ts".to_string()],
             llm_confidence: 0.9,
         };
@@ -1048,7 +1048,7 @@ mod tests {
             action_type: ActionType::CreateFile {
                 path: "config.rs".to_string(),
             },
-            content: r#"const API_KEY = "abcdef1234567890abcdef""#.to_string(), // test fixture
+            content: r#"const API_KEY = "abcdef1234567890abcdef""#.to_string(), // test fixture — scanner-allow: rust-secrets
             files_affected: vec!["config.rs".to_string()],
             llm_confidence: 0.9,
         };
diff --git a/tests/gating_pipeline_test.rs b/tests/gating_pipeline_test.rs
index efdad43..9b1b7fc 100644
--- a/tests/gating_pipeline_test.rs
+++ b/tests/gating_pipeline_test.rs
@@ -78,7 +78,7 @@ fn e2e_hardcoded_secret_blocked() {
     let runner = ContractRunner::new();
     let proposal = create_proposal(
         "config.rs",
-        r#"const password = "supersecretpassword123456789abcde""#,
+        r#"const password = "supersecretpassword123456789abcde""#,  // scanner-allow: rust-secrets
     );
     let request = GatingRequest::new(proposal);
 
diff --git a/tests/security_aspect_test.rs b/tests/security_aspect_test.rs
index 803ee78..56597df 100644
--- a/tests/security_aspect_test.rs
+++ b/tests/security_aspect_test.rs
@@ -309,7 +309,7 @@ fn security_forbidden_pattern_detection() {
 
     // Test secret patterns
     let secret_patterns = vec![
-        r#"password = "thisisasecret123456""#,
+        r#"password = "thisisasecret123456""#,  // scanner-allow: rust-secrets
         r#"secret = "thisisasecret123456""#,
         r#"api_key = "thisisasecret123456""#,
     ];