1# Going public shows a repo's whole history at once, so public first runs2# the secret check over all of it: a key added and removed long ago keeps3# the repo private, unless --force. Pushes to a private repo are checked too.4. "$(dirname "$0")/../lib.sh"5user dami6repo --private dami/secret7clone dami dami/secret "$T/w/dami"8key="AKIA$(printf 'QWERTYUIOPASDFGH')"9printf 'aws_key = %s\n' "$key" >"$T/w/dami/config.ini"10at "$T/w/dami" commit "add config" config.ini11fails_with "this push adds what looks like a credential" push_as dami "$T/w/dami" origin main12ok push_as dami "$T/w/dami" -o allow-secret origin main13at "$T/w/dami" git rm -q config.ini14at "$T/w/dami" commit "no config"15ok push_as dami "$T/w/dami" origin main1617fails_with "dami/secret stays private: its history has what looks like a credential" ssh_as dami public dami/secret18has "$T_LOG" "this repo's history has what looks like a credential"19has "$T_LOG" 'config.ini:1 in .*AWS access key id'20missing "$FORGE_ROOT/dami/secret.git/git-daemon-export-ok"21ok ssh_as dami public dami/secret --force22has "$T_LOG" 'making dami/secret public anyway'23exists "$FORGE_ROOT/dami/secret.git/git-daemon-export-ok"2425# A clean history goes public without --force. One in an old revision of a26# review (refs/forge/keep, which review pages show) is found too.27repo --private dami/clean28clone dami dami/clean "$T/w/clean"29at "$T/w/clean" commit "first"30ok push_as dami "$T/w/clean" origin main31ok ssh_as dami public dami/clean32exists "$FORGE_ROOT/dami/clean.git/git-daemon-export-ok"33ok ssh_as dami private dami/clean34at "$T/w/clean" git switch -q -c dami/oops35printf 'token: %s\n' "$key" >"$T/w/clean/notes.txt"36at "$T/w/clean" commit "oops" notes.txt37ok push_as dami "$T/w/clean" -o allow-secret origin dami/oops38at "$T/w/clean" git rm -q notes.txt39at "$T/w/clean" git commit -q --amend --allow-empty -m "fixed"40ok push_as dami "$T/w/clean" -f origin dami/oops41fails_with "stays private" ssh_as dami public dami/clean42has "$T_LOG" 'notes.txt:1'