SK-3015 move dummy/fake test secrets into dummy-non-secrets folder (#422)

Gitleaks flagged 5 findings (generic-api-key x3, private-key x2) in test
code for a shared dummy API key and fake PEM private keys. Per the
ticket's ignorance strategy, dummy/fake secrets now live in resource
files under a dummy-non-secrets/ folder (per module), which is excluded
from Gitleaks scans via a new path allowlist entry in Rule/gitleaks.toml,
instead of as string literals in the .java source.

- common/src/test/resources/dummy-non-secrets/invalidTokenURICredentials.json
  (moved from src/test/resources/, reference in BearerTokenTests.java updated)
- common/src/test/resources/dummy-non-secrets/invalidKeySpecCredentials.json
  (new; SignedDataTokensTests#testInvalidKeySpecInCredentials now loads
  it as a file instead of inlining the fake PEM key)
- common/src/test/resources/dummy-non-secrets/dummy-api-key.txt and
  skyvault/src/test/resources/dummy-non-secrets/dummy-api-key.txt (new;
  CredentialsTests, ConnectionClientTests, and VaultClientTests now load
  the dummy API key from disk instead of hardcoding it)

Scope limited to the 5 findings named in SK-3015; other pre-existing
occurrences of the same dummy secrets elsewhere in the test suite are
unchanged.

Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>

Author: Devesh-Skyflow

Rule/gitleaks.toml

@@ -61,6 +61,7 @@ paths = [
     '''\.gem$''',
     '''verification-metadata\.xml''',
     '''Database.refactorlog''',
+    '''(?:^|/)dummy-non-secrets(?:/.*)?$''',
 ]
 stopwords = [
     "abcdefghijklmnopqrstuvwxyz",

common/src/test/java/com/skyflow/config/CredentialsTests.java

@@ -9,6 +9,10 @@
 import org.junit.BeforeClass;
 import org.junit.Test;
 
+import java.io.IOException;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.nio.file.Paths;
 import java.util.ArrayList;
 import java.util.HashMap;
 import java.util.Map;
@@ -25,12 +29,15 @@ public class CredentialsTests {
     private static String role = null;
     private static String context = null;
 
+    // Dummy API key lives outside the source tree, in a resource file under dummy-non-secrets/
+    // (excluded from Gitleaks scans), rather than as a string literal here.
     @BeforeClass
-    public static void setup() {
+    public static void setup() throws IOException {
         path = "valid-path-to-credentials-file";
         credentialsString = "valid-credentials-string";
         token = "valid-token";
-        validApiKey = "sky-ab123-abcd1234cdef1234abcd4321cdef4321";
+        validApiKey = new String(Files.readAllBytes(
+                Paths.get("./src/test/resources/dummy-non-secrets/dummy-api-key.txt")), StandardCharsets.UTF_8).trim();
         invalidApiKey = "invalid-api-key";
         roles = new ArrayList<>();
         role = "test_credentials_role";

common/src/test/java/com/skyflow/serviceaccount/util/BearerTokenTests.java

@@ -249,7 +249,7 @@ public void testInvalidKeySpecInCredentialsForCredentials() {
 
     @Test
     public void testInvalidTokenURIInCredentialsForCredentials() throws SkyflowException {
-        String filePath = "./src/test/resources/invalidTokenURICredentials.json";
+        String filePath = "./src/test/resources/dummy-non-secrets/invalidTokenURICredentials.json";
         File file = new File(filePath);
         try {
             BearerToken bearerToken = BearerToken.builder().setCredentials(file).build();

common/src/test/java/com/skyflow/serviceaccount/util/SignedDataTokensTests.java

@@ -215,9 +215,12 @@ public void testInvalidPrivateKeyInCredentials() {
 
     @Test
     public void testInvalidKeySpecInCredentials() {
-        String credentialsString = "{\"privateKey\": \"-----BEGIN PRIVATE KEY-----\\ncHJpdmF0ZV9rZXlfdmFsdWU=\\n-----END PRIVATE KEY-----\", \"clientID\": \"client_id_value\", \"keyID\": \"key_id_value\", \"tokenURI\": \"invalid_token_uri\"}";
+        // Dummy credentials (with a fake, invalid privateKey) live outside the source tree, in a
+        // resource file under dummy-non-secrets/ (excluded from Gitleaks scans).
+        String filePath = "./src/test/resources/dummy-non-secrets/invalidKeySpecCredentials.json";
+        File file = new File(filePath);
         try {
-            SignedDataTokens signedTokens = SignedDataTokens.builder().setCredentials(credentialsString).build();
+            SignedDataTokens signedTokens = SignedDataTokens.builder().setCredentials(file).build();
             signedTokens.getSignedDataTokens();
             Assert.fail(EXCEPTION_NOT_THROWN);
         } catch (SkyflowException e) {

common/src/test/resources/dummy-non-secrets/dummy-api-key.txt

@@ -0,0 +1 @@
+sky-ab123-abcd1234cdef1234abcd4321cdef4321

common/src/test/resources/dummy-non-secrets/invalidKeySpecCredentials.json

@@ -0,0 +1 @@
+{"privateKey": "-----BEGIN PRIVATE KEY-----\ncHJpdmF0ZV9rZXlfdmFsdWU=\n-----END PRIVATE KEY-----", "clientID": "client_id_value", "keyID": "key_id_value", "tokenURI": "invalid_token_uri"}

…esources/invalidTokenURICredentials.json …-secrets/invalidTokenURICredentials.jsoncommon/src/test/resources/invalidTokenURICredentials.json renamed to common/src/test/resources/dummy-non-secrets/invalidTokenURICredentials.json common/src/test/resources/invalidTokenURICredentials.json renamed to common/src/test/resources/dummy-non-secrets/invalidTokenURICredentials.json

@@ -7,6 +7,11 @@
 import org.junit.Before;
 import org.junit.Test;
 
+import java.io.IOException;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.nio.file.Paths;
+
 public class ConnectionClientTests {
     private static final String INVALID_EXCEPTION_THROWN = "Should not have thrown any exception";
     private static final String EXCEPTION_NOT_THROWN = "Should have thrown an exception";
@@ -19,11 +24,15 @@ public class ConnectionClientTests {
     // @Before (not @BeforeClass): several tests below mutate the shared connectionClient/
     // connectionConfig credentials state, so it must reset before every test rather than once
     // per class — otherwise test outcomes depend on JUnit's (unspecified) method execution order.
+    //
+    // Dummy API key lives outside the source tree, in a resource file under dummy-non-secrets/
+    // (excluded from Gitleaks scans), rather than as a string literal here.
     @Before
-    public void setup() {
+    public void setup() throws IOException {
         connectionID = "connection123";
         connectionURL = "https://test.connection.url";
-        apiKey = "sky-ab123-abcd1234cdef1234abcd4321cdef4321";
+        apiKey = new String(Files.readAllBytes(
+                Paths.get("./src/test/resources/dummy-non-secrets/dummy-api-key.txt")), StandardCharsets.UTF_8).trim();
 
         Credentials credentials = new Credentials();
         credentials.setApiKey(apiKey);

skyvault/src/test/java/com/skyflow/ConnectionClientTests.java

@@ -45,6 +45,10 @@
 import org.mockito.Mockito;
 
 import java.io.File;
+import java.io.IOException;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.nio.file.Paths;
 import java.util.*;
 import java.util.Arrays;
 import java.util.Collections;
@@ -58,16 +62,18 @@ public class VaultClientTests {
     private static String table = null;
     private static String value = null;
     private static String columnGroup = null;
-    private static String apiKey = "sky-ab123-abcd1234cdef1234abcd4321cdef4321";
+    private static String apiKey = null;
     private static ArrayList<DetokenizeData> detokenizeData = null;
     private static ArrayList<HashMap<String, Object>> insertValues = null;
     private static ArrayList<HashMap<String, Object>> insertTokens = null;
     private static HashMap<String, Object> valueMap = null;
     private static HashMap<String, Object> tokenMap = null;
     private static VaultConfig vaultConfig;
 
+    // Dummy API key lives outside the source tree, in a resource file under dummy-non-secrets/
+    // (excluded from Gitleaks scans), rather than as a string literal here.
     @BeforeClass
-    public static void setup() throws SkyflowException {
+    public static void setup() throws SkyflowException, IOException {
         vaultID = "vault123";
         clusterID = "cluster123";
         token = "test_token";
@@ -86,8 +92,10 @@ public static void setup() throws SkyflowException {
         vaultConfig.setClusterId(clusterID);
         vaultConfig.setEnv(Env.PROD);
 
+        String dummyApiKey = new String(Files.readAllBytes(
+                Paths.get("./src/test/resources/dummy-non-secrets/dummy-api-key.txt")), StandardCharsets.UTF_8).trim();
         Credentials credentials = new Credentials();
-        credentials.setApiKey("sky-ab123-abcd1234cdef1234abcd4321cdef4321");
+        credentials.setApiKey(dummyApiKey);
         vaultConfig.setCredentials(credentials);
         vaultClient = new VaultClient(vaultConfig, credentials);
         vaultClient.setBearerToken();

skyvault/src/test/java/com/skyflow/VaultClientTests.java

@@ -0,0 +1 @@
+sky-ab123-abcd1234cdef1234abcd4321cdef4321