完善 readiness、发布追溯与敏感治理（07-15-production-trust-closeout-cleanup）

server/tests/unit/scripts/check-sensitive-content.test.js

@@ -0,0 +1,77 @@
+const path = require("node:path");
+const { pathToFileURL } = require("node:url");
+
+const ROOT_DIR = path.resolve(__dirname, "../../../..");
+let scanner;
+
+describe("current fact-source sensitive content gate", () => {
+  beforeAll(async () => {
+    const scriptPath = path.join(ROOT_DIR, "scripts/qa/check-sensitive-content.mjs");
+    scanner = await import(pathToFileURL(scriptPath).href);
+  });
+
+  it("reports only redacted metadata for secret, account, path and infrastructure matches", () => {
+    const source = [
+      "SERVICE_PASSWORD=do-not-disclose-value",
+      "[email protected]",
+      "phone=13800000000",
+      "workspace=/home/developer/private/project",
+      "server=203.0.113.10",
+    ].join("\n");
+
+    const findings = scanner.scanSensitiveText(source, "fixture.md");
+
+    expect(findings.map((item) => item.category)).toEqual(expect.arrayContaining([
+      "assigned_secret",
+      "email_account",
+      "phone_account",
+      "personal_workspace_path",
+      "public_ipv4",
+    ]));
+    expect(JSON.stringify(findings)).not.toMatch(/do-not-disclose|person@|13800000000|203\.0\.113\.10/);
+  });
+
+  it("allows explicit placeholders, environment interpolation and loopback addresses", () => {
+    const source = [
+      "SERVICE_PASSWORD=<managed-secret>",
+      "DATABASE_URL=${LOCAL_DATABASE_URL}",
+      "admin=<admin-email>",
+      "workspace=<repo-root>/server",
+      "server=127.0.0.1",
+    ].join("\n");
+
+    expect(scanner.scanSensitiveText(source, "fixture.md")).toEqual([]);
+  });
+
+  it("derives current docs from the status matrix without pulling historical issue rows", () => {
+    const matrix = [
+      "| ID | Contract | Type | Purpose | Status |",
+      "| --- | --- | --- | --- | --- |",
+      "| `CURRENT-DOC` | `docs/current.md` | fact | current | `CURRENT` |",
+      "| `HISTORY-DOC` | `docs/history.md` | evidence | old | `EVIDENCE` |",
+      "| `CURRENT-ISSUE` | `issues/current.csv` | `CURRENT` | issue only |",
+    ].join("\n");
+
+    expect(scanner.extractCurrentDocumentFiles(matrix)).toEqual(["docs/current.md"]);
+  });
+
+  it("includes every CURRENT docs contract in the default scan set", () => {
+    const files = scanner.resolveDefaultScanFiles(ROOT_DIR);
+
+    expect(files).toEqual(expect.arrayContaining([
+      "docs/测试规约与回归门禁.md",
+      "docs/需求-资产管理规约.md",
+      "docs/管理员手册.md",
+      "docs/员工快速上手.md",
+    ]));
+  });
+
+  it("passes the registered current fact sources and deployment entrypoints", () => {
+    expect(scanner.scanSensitiveContent({ rootDir: ROOT_DIR })).toMatchObject({
+      status: "PASS",
+      findingCount: 0,
+      filesScanned: expect.any(Number),
+      findings: [],
+    });
+  });
+});