feat: complete production workflow migration

tests/test_security_scanner.py

@@ -34,7 +34,10 @@ def test_scan_repository_reports_only_location_and_rule(tmp_path):
     assert set(asdict(findings[0])) == {"file", "line", "rule"}
 
 
-@pytest.mark.parametrize("directory", ["var", ".git", ".venv", ".learnings"])
+@pytest.mark.parametrize(
+    "directory",
+    ["var", ".git", ".venv", ".learnings", "build", "dist", "demo.egg-info"],
+)
 def test_scan_repository_excludes_runtime_and_tool_directories(tmp_path, directory):
     from gyxx_flow.security.scanner import scan_repository
 
@@ -106,6 +109,39 @@ def test_scan_repository_ignores_declarations_references_and_comparisons(tmp_pat
     assert scan_repository(tmp_path) == []
 
 
+def test_scan_repository_ignores_runtime_secret_subscript_references(tmp_path):
+    from gyxx_flow.security.scanner import scan_repository
+
+    source = tmp_path / "src" / "runtime.py"
+    source.parent.mkdir()
+    sensitive_name = "pass" + "word"
+    token_name = "access_" + "token"
+    source.write_text(
+        f'{sensitive_name} = runtime_config["{sensitive_name}"]\n'
+        f"{token_name} = settings.{token_name}\n",
+        encoding="utf-8",
+    )
+
+    assert scan_repository(tmp_path) == []
+
+
+def test_scan_repository_detects_bare_identifier_shaped_plaintext(tmp_path):
+    from gyxx_flow.security.scanner import scan_repository
+
+    source = tmp_path / "config" / "application.env"
+    source.parent.mkdir()
+    credential_name = "DATABASE_" + "PASSWORD"
+    credential_value = "sword" + "fish123"
+    source.write_text(
+        f"{credential_name}={credential_value}\n",
+        encoding="utf-8",
+    )
+
+    assert [(item.line, item.rule) for item in scan_repository(tmp_path)] == [
+        (1, "plaintext-credential")
+    ]
+
+
 def test_scan_repository_rejects_a_non_directory_root(tmp_path):
     from gyxx_flow.security.scanner import scan_repository
 
@@ -131,3 +167,58 @@ def test_scan_repository_detects_multiline_environment_secret_default(tmp_path):
     assert [(item.line, item.rule) for item in findings] == [
         (1, "hardcoded-long-hex-credential")
     ]
+
+
+def test_scan_repository_detects_plaintext_environment_fallback(tmp_path):
+    from gyxx_flow.security.scanner import scan_repository
+
+    password_name = "SYCM_" + "PASSWORD"
+    fallback = "not-a-real-" + "browser-secret-31c8"
+    source = tmp_path / "collector.py"
+    source.write_text(
+        f'{password_name} = os.getenv("{password_name}", "{fallback}")\n',
+        encoding="utf-8",
+    )
+
+    findings = scan_repository(tmp_path)
+
+    assert [(item.line, item.rule) for item in findings] == [
+        (1, "plaintext-environment-fallback")
+    ]
+
+
+def test_scan_repository_detects_identifier_shaped_environment_fallback(tmp_path):
+    from gyxx_flow.security.scanner import scan_repository
+
+    credential_name = "PASS" + "WORD"
+    fallback = "sword" + "fish123"
+    source = tmp_path / "collector.py"
+    source.write_text(
+        f'{credential_name} = os.getenv("{credential_name}", "{fallback}")\n',
+        encoding="utf-8",
+    )
+
+    findings = scan_repository(tmp_path)
+
+    assert [(item.line, item.rule) for item in findings] == [
+        (1, "plaintext-environment-fallback")
+    ]
+
+
+def test_scan_repository_detects_multiline_plaintext_environment_fallback(tmp_path):
+    from gyxx_flow.security.scanner import scan_repository
+
+    credential_name = "PASS" + "WORD"
+    fallback = "sword" + "fish123"
+    source = tmp_path / "collector.py"
+    source.write_text(
+        f'{credential_name} = os.getenv(\n    "{credential_name}",\n'
+        f'    "{fallback}",\n)\n',
+        encoding="utf-8",
+    )
+
+    findings = scan_repository(tmp_path)
+
+    assert [(item.line, item.rule) for item in findings] == [
+        (1, "plaintext-environment-fallback")
+    ]