Functions
	test_direct_assignment_violation ()
	test_direct_assignment_multiple_violations ()
	test_annotated_assignment_violation ()
	test_class_attribute_violation ()
	test_dict_literal_violation ()
	test_dict_multiple_secret_keys ()
	test_dict_non_secret_key_passes ()
	test_dict_secret_key_call_value_passes ()
	test_function_default_violation ()
	test_kwonly_default_violation ()
	test_function_default_non_secret_passes ()
	test_os_getenv_passes ()
	test_os_environ_subscript_passes ()
	test_function_call_passes ()
	test_subscript_on_non_environ_passes ()
	test_non_secret_name_with_string_passes ()
	test_fstring_caught ()
	test_concatenation_caught ()
	test_concat_with_variable_caught ()
	test_fstring_non_secret_name_passes ()
	test_empty_file_passes ()
	test_syntax_error_passes ()
	test_all_secret_patterns_caught ()
	test_case_insensitive_matching ()
	test_compound_name_violation ()
	test_prefixed_api_key_violation ()
	test_suffixed_token_violation ()
	test_non_secret_compound_passes ()
	test_waiver_without_reason_parsed_correctly ()
	test_waiver_with_reason_parsed_correctly ()
	test_waiver_filtering_excludes_reasonless ()

Detailed Description

Purpose
-------
Validate the linter's ``no_hardcoded_secrets`` rule (§6b Secret Hygiene).

Responsibilities
----------------
- Confirm that hardcoded secrets in direct assignments are caught (Pattern A).
- Confirm that hardcoded secrets in annotated assignments are caught (Pattern A).
- Confirm that hardcoded secrets in dict literals are caught (Pattern B).
- Confirm that hardcoded secrets in function defaults are caught (Pattern C).
- Confirm that safe patterns (os.getenv, os.environ, function calls,
  subscripts) pass without violations.
- Confirm that non-secret variable names with string literals pass.
- Confirm profile behaviour (strict/compact: blocking; proto: not checked).

Diagnostics
-----------
Domain: LINTER-TESTS
L2: test lifecycle
L3: assertion details
L4: deep tracing

Contracts
---------
Inputs:  inline source strings
Outputs: pass/fail assertions

Function Documentation

◆ test_all_secret_patterns_caught()

tests_linter.test_no_hardcoded_secrets.test_all_secret_patterns_caught ( )

Every name in _SECRET_NAME_PATTERNS is caught when assigned a literal.

Definition at line 241 of file test_no_hardcoded_secrets.py.

◆ test_annotated_assignment_violation()

tests_linter.test_no_hardcoded_secrets.test_annotated_assignment_violation ( )

Annotated assignment (name: str = "literal") is caught.

Definition at line 62 of file test_no_hardcoded_secrets.py.

◆ test_case_insensitive_matching()

tests_linter.test_no_hardcoded_secrets.test_case_insensitive_matching ( )

Secret name matching is case-insensitive.

Definition at line 249 of file test_no_hardcoded_secrets.py.

◆ test_class_attribute_violation()

tests_linter.test_no_hardcoded_secrets.test_class_attribute_violation ( )

Class-level secret attribute is caught (AST walker visits class bodies).

Definition at line 70 of file test_no_hardcoded_secrets.py.

◆ test_compound_name_violation()

tests_linter.test_no_hardcoded_secrets.test_compound_name_violation ( )

Compound variable names containing secret patterns are caught (OI-402).

Definition at line 261 of file test_no_hardcoded_secrets.py.

◆ test_concat_with_variable_caught()

tests_linter.test_no_hardcoded_secrets.test_concat_with_variable_caught ( )

Concatenation where one side is a literal is flagged (OI-408).

Definition at line 210 of file test_no_hardcoded_secrets.py.

◆ test_concatenation_caught()

tests_linter.test_no_hardcoded_secrets.test_concatenation_caught ( )

String concatenation assigned to secret-named variable is flagged (OI-408).

Definition at line 202 of file test_no_hardcoded_secrets.py.

◆ test_dict_literal_violation()

tests_linter.test_no_hardcoded_secrets.test_dict_literal_violation ( )

Dict with secret-like key mapped to a string literal is caught.

Definition at line 85 of file test_no_hardcoded_secrets.py.

◆ test_dict_multiple_secret_keys()

tests_linter.test_no_hardcoded_secrets.test_dict_multiple_secret_keys ( )

Dict with multiple secret keys produces multiple violations.

Definition at line 93 of file test_no_hardcoded_secrets.py.

◆ test_dict_non_secret_key_passes()

tests_linter.test_no_hardcoded_secrets.test_dict_non_secret_key_passes ( )

Dict with non-secret key and string value passes.

Definition at line 102 of file test_no_hardcoded_secrets.py.

◆ test_dict_secret_key_call_value_passes()

tests_linter.test_no_hardcoded_secrets.test_dict_secret_key_call_value_passes ( )

Dict with secret key mapped to a function call passes.

Definition at line 109 of file test_no_hardcoded_secrets.py.

◆ test_direct_assignment_multiple_violations()

tests_linter.test_no_hardcoded_secrets.test_direct_assignment_multiple_violations ( )

Multiple secret assignments produce multiple violation messages.

Definition at line 50 of file test_no_hardcoded_secrets.py.

◆ test_direct_assignment_violation()

tests_linter.test_no_hardcoded_secrets.test_direct_assignment_violation ( )

String literal assigned to a secret-like variable name is caught.

Definition at line 41 of file test_no_hardcoded_secrets.py.

◆ test_empty_file_passes()

tests_linter.test_no_hardcoded_secrets.test_empty_file_passes ( )

Empty file passes.

Definition at line 225 of file test_no_hardcoded_secrets.py.

◆ test_fstring_caught()

tests_linter.test_no_hardcoded_secrets.test_fstring_caught ( )

f-string assigned to secret-named variable is flagged (OI-408).

Definition at line 194 of file test_no_hardcoded_secrets.py.

◆ test_fstring_non_secret_name_passes()

tests_linter.test_no_hardcoded_secrets.test_fstring_non_secret_name_passes ( )

f-string assigned to a non-secret variable name is fine (OI-408).

Definition at line 218 of file test_no_hardcoded_secrets.py.

◆ test_function_call_passes()

tests_linter.test_no_hardcoded_secrets.test_function_call_passes ( )

Assigning a function call result to a secret name passes.

Definition at line 170 of file test_no_hardcoded_secrets.py.

◆ test_function_default_non_secret_passes()

tests_linter.test_no_hardcoded_secrets.test_function_default_non_secret_passes ( )

Function with non-secret parameter defaulting to string passes.

Definition at line 139 of file test_no_hardcoded_secrets.py.

◆ test_function_default_violation()

tests_linter.test_no_hardcoded_secrets.test_function_default_violation ( )

Function with secret-like parameter defaulting to string literal is caught.

Definition at line 123 of file test_no_hardcoded_secrets.py.

◆ test_kwonly_default_violation()

tests_linter.test_no_hardcoded_secrets.test_kwonly_default_violation ( )

Keyword-only parameter with secret default is caught.

Definition at line 131 of file test_no_hardcoded_secrets.py.

◆ test_non_secret_compound_passes()

tests_linter.test_no_hardcoded_secrets.test_non_secret_compound_passes ( )

Compound name that does not contain a secret pattern passes.

Definition at line 283 of file test_no_hardcoded_secrets.py.

◆ test_non_secret_name_with_string_passes()

tests_linter.test_no_hardcoded_secrets.test_non_secret_name_with_string_passes ( )

Variable with non-secret name assigned string literal passes.

Definition at line 187 of file test_no_hardcoded_secrets.py.

◆ test_os_environ_subscript_passes()

tests_linter.test_no_hardcoded_secrets.test_os_environ_subscript_passes ( )

os.environ["KEY"] is a subscript, not a literal — passes.

Definition at line 160 of file test_no_hardcoded_secrets.py.

◆ test_os_getenv_passes()

tests_linter.test_no_hardcoded_secrets.test_os_getenv_passes ( )

os.getenv() is a function call, not a literal — passes.

Definition at line 150 of file test_no_hardcoded_secrets.py.

◆ test_prefixed_api_key_violation()

tests_linter.test_no_hardcoded_secrets.test_prefixed_api_key_violation ( )

Prefixed secret name like stripe_api_key is caught (OI-402).

Definition at line 269 of file test_no_hardcoded_secrets.py.

◆ test_subscript_on_non_environ_passes()

tests_linter.test_no_hardcoded_secrets.test_subscript_on_non_environ_passes ( )

Subscript on a non-environ object passes (known limitation).

Definition at line 177 of file test_no_hardcoded_secrets.py.

◆ test_suffixed_token_violation()

tests_linter.test_no_hardcoded_secrets.test_suffixed_token_violation ( )

Suffixed secret name like refresh_token_value is caught (OI-402).

Definition at line 276 of file test_no_hardcoded_secrets.py.

◆ test_syntax_error_passes()

tests_linter.test_no_hardcoded_secrets.test_syntax_error_passes ( )

Unparseable source passes (same behaviour as other AST-based checks).

Definition at line 231 of file test_no_hardcoded_secrets.py.

◆ test_waiver_filtering_excludes_reasonless()

tests_linter.test_no_hardcoded_secrets.test_waiver_filtering_excludes_reasonless ( )

The waived_rules set only includes waivers with a reason (OI-404).

Definition at line 312 of file test_no_hardcoded_secrets.py.

◆ test_waiver_with_reason_parsed_correctly()

tests_linter.test_no_hardcoded_secrets.test_waiver_with_reason_parsed_correctly ( )

parse_inline_waivers captures reason when provided (OI-404).

Definition at line 303 of file test_no_hardcoded_secrets.py.

◆ test_waiver_without_reason_parsed_correctly()

tests_linter.test_no_hardcoded_secrets.test_waiver_without_reason_parsed_correctly ( )

parse_inline_waivers sets reason=None when no reason is given (OI-404).

Definition at line 294 of file test_no_hardcoded_secrets.py.

Functions