Every existing test asserted the history scan reports nothing — on this
repository, which has never committed a credential. That is the wrong
direction to test alone: a detector exercised only against clean input
is indistinguishable from a function that returns an empty vector, and
this one has already shipped four false-negative-shaped bugs today.
The new test builds a repository from scratch by writing zlib-compressed
git objects directly — no subprocess, for the same reason the scanner
uses none — commits a key, and leaves no working-tree copy at all. Only
the history has it, which is the situation the whole module exists for.
It asserts the scan finds it, names the file, says revoke, and does not
carry the credential's value into the finding. The fixture key is
assembled at runtime so this source file does not itself contain a
credential-shaped string, which is the trap that made the detector
report its own definitions earlier today.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
1f45e0c611