* detectors/github/v2: differentiate token type in ExtraData
FromData matched all six GitHub token prefixes (ghp_, github_pat_,
gho_, ghu_, ghs_, ghr_) with a single regex, but every match was
tagged with the same DetectorType_Github and the same hardcoded PAT
description. The matched prefix was discarded before it could reach
any downstream consumer.
Add token_type and remediation to ExtraData, following the same
convention already used by the launchdarkly, slack, and larksuite
detectors, so consumers can tell a leaked OAuth/GitHub App token
apart from a classic or fine-grained PAT and point users at the
correct GitHub settings page to revoke it.
* detectors/github/v2: drop remediation field, add token_type test coverage
Per review feedback on #5223: remove the remediation field from ExtraData
(maintainers are expanding howtorotate.com docs instead, and want to keep
the additive ExtraData surface minimal for downstream consumers). This
also moots the ghr_ remediation-URL bug Bugbot flagged, since that field
no longer exists. Add table-driven tests for token_type mapping plus a
drift guard ensuring every keyPat prefix has a tokenTypesByPrefix entry.
* detectors/github/v2: fix integration test expectations for token_type
Bugbot caught this on the merge-into-branch commit: github_integration_test.go
does an exact ExtraData comparison via pretty.Compare and didn't account for
the new token_type field, so every case would fail under the detectors build
tag. Add the expected token_type per case.
* detectors/github/v2: derive drift guard from keyPat's own regex source
TestGithubTokenType_KeyPatPrefixesCovered compared tokenTypesByPrefix
against a second hand-maintained prefix list, so a new prefix added to
keyPat and forgotten in the map could also be forgotten in that list,
leaving the "drift guard" green with nothing to catch. Replace it with
TestGithubTokenType_MappingMatchesKeyPatExactly, which parses the prefix
alternation out of keyPat.String() directly, and
TestGithubTokenType_EveryKeyPatPrefixResolves, which builds a token per
derived prefix and confirms it resolves to a real type end to end.
* detectors/github/v2: add row-level validation for tokenTypesByPrefix
The keyPat drift guards check that map keys line up with the regex; they
say nothing about whether an individual row is well-formed. A malformed
row with a correct key (blank value, or a value copy-pasted from another
prefix) would slip through both. Add TestTokenTypesByPrefix_RowsAreWellFormed
to check each row in isolation: prefix key ends in "_", value is non-blank,
value isn't the reserved "Unknown GitHub token" fallback, and no two
prefixes share a value. Verified it fails on an injected duplicate-value
row before reverting the injection.
* detectors/github/v2: make row-blank-field check reflect-based, forward-looking
TestTokenTypesByPrefix_RowsAreWellFormed only checked the current string
value for blankness. That check is presence-only in the sense the removed
TestGithubTokenType_KeyPatPrefixesCovered was: neither would have caught a
row whose value type is a struct with a field left at its zero value (the
shape tokenTypesByPrefix had before remediation was dropped, and could have
again). Replace the direct blank check with assertNoBlankFields, which
recurses into struct fields via reflection, so a future second field on a
row is covered automatically instead of needing a matching manual check.
Verified against a probe using the pre-removal {TokenType, Remediation}
struct shape with one field left blank before writing this commit.
Shawn Hartsock
8ee38640f6