test(redact): assemble credential-shaped fixtures at runtime

[senamakel]

Part of tinyhumansai/openhuman#7328. Follow-up to #19, which merged before this commit landed: the documented AWS example key id and a dummy PEM block are built at runtime so the commits scanner stops flagging the fixtures. Test-only.

Summary by CodeRabbit

• Tests
  • Updated checks for credential redaction using assembled sample values. The expected redaction behavior is unchanged.
• User-visible changes
  • No changes to product behavior are included in this update.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-15T17:12:50.813386Z	079702d	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 40bca7d4-bac8-4da4-a4d7-09a8d282e990

📥 Commits

Reviewing files that changed from the base of the PR and between 3d440ee and 079702d.

📒 Files selected for processing: 1

• crates/tinysecurity-redact/src/lib_tests.rs

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📝 Walkthrough

The credentials-redaction test now builds AWS credential and PEM key examples from string fragments and uses the constructed values in its test cases and leak assertion.

Changes: Credentials redaction test

Layer / File(s)	Summary
Construct and check secret examples crates/tinysecurity-redact/src/lib_tests.rs	The test constructs AWS and PEM examples from fragments. The secret cases use those values, and the leak assertion checks for the constructed AWS credential.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to 07970

This test-only change preserves checks for AWS and PEM redaction, so no actionable merge risk remains.

### Architecture Summary

Architecture risk: 🔵 Low · up to 07970

The change affects 1 system.

Changed systems: crates

Architecture concerns
No architecture-level concerns identified.

Review details

Systems and components

• observed — crates (service) was modified; 1 changed file maps to changed impact.

Before / after behavior

• observed — Modified behavior in crates/tinysecurity-redact/src/lib_tests.rs: The test now builds the AWS credential and PEM key examples by concatenating string fragments instead of embedding each complete value directly.
• observed — Modified behavior in crates/tinysecurity-redact/src/lib_tests.rs: The AWS secret test case now uses the constructed aws value.
• observed — Modified behavior in crates/tinysecurity-redact/src/lib_tests.rs: The PEM secret test case now uses the constructed pem value.
• observed — Modified behavior in crates/tinysecurity-redact/src/lib_tests.rs: The leak assertion now checks against the constructed AWS credential.

Pre-merge checks: 5

Passed checks: 5 passed

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the test-only change: assembling credential-shaped fixtures at runtime to avoid scanner detection.
Docstring Coverage		Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 1 files.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches: 💡 1

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🛠️ Fix failing CI checks: 💡

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{A rabbit checks each secret string,
With fragments joined in careful spring.
The AWS value takes its place,
The PEM key joins the test case.
No leaked credential skips the trace,
Then off hops Bun at a steady pace.}

_{Comment @coderabbitai help to get the list of available commands.}