Repository navigation
test: expand trace redaction regression coverage #29
Description
Problem
Trace redaction needs reliable regression coverage for common credential formats and nested data structures. Users should understand that redaction is best effort and does not guarantee that every secret will be removed.
Scope
Inspect the existing redaction implementation (src/stepfork/trace/redaction.py) and tests (tests/unit/test_redaction.py). Add fixtures using fake credentials only. Cover supported credential formats, nested dictionaries and lists, secrets embedded in exception messages where relevant, and ordinary values that should remain unchanged.
If testing reveals a real leak, add a reproducible regression test and propose the smallest appropriate fix.
Acceptance criteria
- Fixtures never contain real credentials.
- Tests verify expected redaction and preservation of unrelated values.
- Existing redaction behavior is documented accurately.
- No guarantee of complete secret removal is claimed.
- All tests are deterministic and run offline.
Testing
Run the focused redaction tests and the full test suite.
Contributions are welcome. Please report the uncovered pattern and expected behavior in your PR description.
Activity
gary1381 commentedon Oct 23, 2026
Thanks again for merging #32! I'd like to take this one.
Plan: extend
tests/unit/test_redaction.pywith fake-credential fixtures for each pattern in_CREDENTIAL_PATTERNSand the sensitive-key set, nested dict/list cases, secrets inside exception/error strings, and values that must stay untouched (including protected fields). A quick local probe already shows a few uncovered cases: anX-Api-Keyheader key,Authorization: Basic ...inside a string, andghs_/AWSAKIA...tokens are all left as-is. I'll add those as tests and list them in the PR description. For any real leaks, I'll propose the smallest fix in a separate commit so you can take or drop it. I'll also make sure the docs say redaction is best effort.I expect to open the PR within a couple of days, with pytest, ruff, mypy, and the mkdocs strict build all passing.