test(batches): rename the two seeded-batch labels that gitleaks reported as secrets

changelog.d/maintenance/13729-rename-wvxc-route-test-labels.md

@@ -0,0 +1,2 @@
+- **test(batches):** the two seeded-batch labels of the delete-completed route-scope suite that sat right after a `key*.id` argument are renamed to short literals (`route401`/`route500`), so a gitleaks scan that reads those lines (full-tree, or git-mode on a branch that adds them) no longer reports them as `generic-api-key` hits ([#13729](https://github.com/diegosouzapw/OmniRoute/pull/13729))
+  — no gate changes: the CI secret ratchet scans `src`/`open-sse`/`bin`/`electron`/`scripts`, never `tests/`

tests/unit/batches-delete-completed-route-scope.test.ts

@@ -62,6 +62,13 @@ async function sessionCookie(): Promise<string> {
   return `auth_token=${jwt}`;
 }
 
+/**
+ * `label` names the seeded batch's `.jsonl` file. Keep it word-shaped or under 10 chars: the
+ * gitleaks generic-api-key rule reports a literal of 10+ chars with Shannon entropy >= 3.5 that
+ * sits right after a `key*.id` argument (the argument supplies the rule's "key" keyword).
+ * `wvxc-route-401` did (entropy 3.66) and became `route401` in #13729; the word-shaped
+ * `wvxc-route-<scenario>` siblings stay under the entropy floor and are clean.
+ */
 function seedCompletedBatch(apiKeyId: string | null, label: string) {
   const file = createFile({
     bytes: 8,
@@ -277,7 +284,8 @@ describe("DELETE /api/v1/batches/delete-completed — caller scope (GHSA-wvxc-jp
 
   it("rejects an unauthenticated request with 401 and deletes nothing", async () => {
     const keyB = await createApiKey("wvxc-route-401-b", "machine-wvxc-401", []);
-    const seeded = seedCompletedBatch(keyB.id, "wvxc-route-401");
+    // short label: see the seedCompletedBatch docblock (#13729)
+    const seeded = seedCompletedBatch(keyB.id, "route401");
 
     const { res, body } = await callDelete({});
 
@@ -290,7 +298,8 @@ describe("DELETE /api/v1/batches/delete-completed — caller scope (GHSA-wvxc-jp
 
   it("returns a sanitized 500 (no stack trace, no raw SQLite message) when the sweep throws, and deletes nothing", async () => {
     const keyA = await createApiKey("wvxc-route-500-a", "machine-wvxc-500", []);
-    const own = seedCompletedBatch(keyA.id, "wvxc-route-500");
+    // short label: see the seedCompletedBatch docblock (#13729)
+    const own = seedCompletedBatch(keyA.id, "route500");
     const db = getDbInstance();
 
     db.exec(
@@ -312,7 +321,7 @@ describe("DELETE /api/v1/batches/delete-completed — caller scope (GHSA-wvxc-jp
     assert.ok(getBatch(own.batch.id), "a failed sweep leaves the batch row in place");
     assert.strictEqual(
       getFileContent(own.file.id)?.toString(),
-      "wvxc-route-500",
+      "route500",
       "a failed sweep rolls the file content back"
     );
   });