refactor(test): factor synthetic GitHub PAT helper into pkg/internal/portcullistest

Both pkg/hooks/builtins/redact_secrets_test.go and pkg/sandbox/kit/
kit_test.go grew an identical CRC32-suffix computation to produce a
synthetic, portcullis-detectable GitHub PAT without hard-coding the
full 40-char ghp_ literal (which would trip GitHub secret-scanning
push protection). Move that computation to a single helper —
portcullistest.FakeGitHubPAT — parameterised by a 30-char body, and
have both tests call it.

Author: dgageot

pkg/hooks/builtins/redact_secrets_test.go

@@ -1,7 +1,6 @@
 package builtins
 
 import (
-	"hash/crc32"
 	"testing"
 
 	"github.com/docker/portcullis"
@@ -10,23 +9,12 @@ import (
 
 	"github.com/docker/docker-agent/pkg/chat"
 	"github.com/docker/docker-agent/pkg/hooks"
+	"github.com/docker/docker-agent/pkg/internal/portcullistest"
 	"github.com/docker/docker-agent/pkg/tools"
 )
 
-// fakeGitHubPAT returns a synthetic GitHub PAT with a body that
-// passes portcullis' CRC32 checksum validation. The full token is
-// never written as a source literal so GitHub's secret-scanning push
-// protection doesn't flag this file.
 func fakeGitHubPAT() string {
-	const body = "cxLeRrvbJfmYdUtr70xnNE3Q7Gvli4"
-	const alphabet = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz"
-	var suffix [6]byte
-	checksum := uint64(crc32.ChecksumIEEE([]byte(body)))
-	for i := len(suffix) - 1; i >= 0; i-- {
-		suffix[i] = alphabet[checksum%62]
-		checksum /= 62
-	}
-	return "ghp_" + body + string(suffix[:])
+	return portcullistest.FakeGitHubPAT("cxLeRrvbJfmYdUtr70xnNE3Q7Gvli4")
 }
 
 // TestRedactSecretsScrubsTopLevelStringValue: a recognised secret in

pkg/internal/portcullistest/fakegithubpat.go

@@ -0,0 +1,33 @@
+// Package portcullistest provides test helpers for code that
+// exercises portcullis' GitHub-token detection rules.
+package portcullistest
+
+import "hash/crc32"
+
+// FakeGitHubPAT returns a synthetic GitHub PAT whose trailing 6-char
+// base62 CRC32 suffix passes portcullis' validGitHubChecksum, so the
+// returned token is detected (and redacted) by the secret scanner.
+//
+// The token is assembled at runtime: the full 40-char `ghp_…` string
+// never appears as a source literal, so GitHub's secret-scanning
+// push protection won't flag files that call this helper.
+//
+// body must be exactly 30 base62 characters; callers vary it to get
+// distinct fake tokens. The result has the GitHub-PAT shape
+// `ghp_` + 36 base62 chars and is never a real credential.
+func FakeGitHubPAT(body string) string {
+	const (
+		alphabet  = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz"
+		suffixLen = 6
+	)
+	if len(body) != 30 {
+		panic("portcullistest: body must be 30 chars")
+	}
+	var suffix [suffixLen]byte
+	checksum := uint64(crc32.ChecksumIEEE([]byte(body)))
+	for i := suffixLen - 1; i >= 0; i-- {
+		suffix[i] = alphabet[checksum%62]
+		checksum /= 62
+	}
+	return "ghp_" + body + string(suffix[:])
+}

pkg/internal/portcullistest/fakegithubpat_test.go

@@ -0,0 +1,28 @@
+package portcullistest_test
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/docker/portcullis"
+	"github.com/stretchr/testify/assert"
+
+	"github.com/docker/docker-agent/pkg/internal/portcullistest"
+)
+
+func TestFakeGitHubPAT_DetectedByPortcullis(t *testing.T) {
+	t.Parallel()
+
+	tok := portcullistest.FakeGitHubPAT("cxLeRrvbJfmYdUtr70xnNE3Q7Gvli4")
+
+	assert.True(t, strings.HasPrefix(tok, "ghp_"))
+	assert.Len(t, tok, 40)
+	assert.True(t, portcullis.Contains(tok), "synthetic PAT must trigger portcullis detection")
+	assert.Equal(t, portcullis.Marker, portcullis.Redact(tok))
+}
+
+func TestFakeGitHubPAT_RejectsWrongLength(t *testing.T) {
+	t.Parallel()
+
+	assert.Panics(t, func() { portcullistest.FakeGitHubPAT("too-short") })
+}

pkg/sandbox/kit/kit_test.go

@@ -2,7 +2,6 @@ package kit
 
 import (
 	"encoding/json"
-	"hash/crc32"
 	"os"
 	"path/filepath"
 	"sort"
@@ -15,25 +14,15 @@ import (
 	"github.com/stretchr/testify/require"
 
 	latestcfg "github.com/docker/docker-agent/pkg/config/latest"
+	"github.com/docker/docker-agent/pkg/internal/portcullistest"
 	"github.com/docker/docker-agent/pkg/promptfiles"
 	"github.com/docker/docker-agent/pkg/skills"
 )
 
-// fakeGitHubToken returns a synthetic GitHub PAT that triggers
-// portcullis. The trailing 6 chars are computed at runtime so the
-// full token never appears as a source literal — otherwise GitHub's
-// secret-scanning push protection would flag this file. Used only as
-// input to the redactor, never as an actual credential.
+// fakeGitHubToken is used only as input to the redactor, never as an
+// actual credential.
 func fakeGitHubToken() string {
-	const body = "1234567890abcdefghijklmnopqrst"
-	const alphabet = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz"
-	var suffix [6]byte
-	checksum := uint64(crc32.ChecksumIEEE([]byte(body)))
-	for i := len(suffix) - 1; i >= 0; i-- {
-		suffix[i] = alphabet[checksum%62]
-		checksum /= 62
-	}
-	return "ghp_" + body + string(suffix[:])
+	return portcullistest.FakeGitHubPAT("1234567890abcdefghijklmnopqrst")
 }
 
 // isolateEnv prevents a developer-exported DOCKER_AGENT_KIT_DIR from