added db guard changes to prevent deletion

2026-03-10 21:19:24 -05:00
parent 479a5ff9d7
commit fe96bf85da
9 changed files with 119 additions and 3 deletions
--- a/api/tests/software-supply-chain-failures.test.ts
+++ b/api/tests/software-supply-chain-failures.test.ts
@@ -31,4 +31,16 @@ describe("A03 Software Supply Chain Failures", () => {

    expect(deployWorkflow).toMatch(/uses:\s*actions\/checkout@v\d+\.\d+\.\d+/);
  });
+
+  it("guards DB-backed security tests from targeting production database", () => {
+    const repoRoot = resolve(__dirname, "..", "..");
+    const securityWorkflow = readFileSync(
+      resolve(repoRoot, ".gitea/workflows/security.yml"),
+      "utf8"
+    );
+
+    expect(securityWorkflow).toContain("name: Guard TEST_DATABASE_URL target");
+    expect(securityWorkflow).toContain("bash ./scripts/validate-test-db-target.sh");
+    expect(securityWorkflow).toContain("TEST_DATABASE_URL: ${{ secrets.TEST_DATABASE_URL }}");
+  });
 });