refactor: fix test failure tracking and enhance secret scanning (#33)

* fix: Improved release test order

* fix: detect secrets adjustments

* fix: improve secrets scanning

just/quality.just

@@ -70,17 +70,29 @@ scan-gitleaks:
 scan-gitleaks-history:
     mise exec -- gitleaks detect --source {{project_root}} --config {{project_root}}/.gitleaks.toml --verbose --log-opts="--all"
 
-# Run detect-secrets scanner (installed via uv)
+# Check for new secrets against baseline (does NOT modify baseline file)
+# Uses pre-commit to run detect-secrets with proper file enumeration
+# Use scan-baseline-update to actually update the baseline
 scan-detect:
-    uv run detect-secrets scan --baseline {{project_root}}/.secrets.baseline
+    @echo "Checking for new secrets against baseline..."
+    @uv run pre-commit run detect-secrets --all-files && echo "✓ No new secrets detected"
 
 # Audit detect-secrets baseline (interactive)
 scan-audit:
     uv run detect-secrets audit {{project_root}}/.secrets.baseline
 
-# Update detect-secrets baseline with new findings (preserves audit metadata)
+# Update detect-secrets baseline with current scan (updates generated_at timestamp)
+# Run this when you want to add new files or refresh the baseline
+# This WILL update the timestamp - only run when you intend to commit changes
 scan-baseline-update:
-    uv run detect-secrets scan --baseline {{project_root}}/.secrets.baseline --update {{project_root}}
+    cd {{project_root}} && uv run detect-secrets scan \
+        --exclude-files '\.secrets\.baseline$$' \
+        --exclude-files '\.gitleaks\.toml$$' \
+        --exclude-files 'uv\.lock$$' \
+        --exclude-files 'poetry\.lock$$' \
+        --exclude-files 'package-lock\.json$$' \
+        --update .secrets.baseline
+    @echo "✓ Baseline updated (run 'just quality::scan-audit' to review any findings)"
 
 # Run trufflehog for verified secrets (via pre-commit - not installed standalone)
 scan-trufflehog:

just/testing.just

@@ -193,12 +193,15 @@ release-test:
 
     # Track overall test results
     TESTS_PASSED=true
-    FAILED_TESTS=""
+    # Arrays to track failures (name and command)
+    declare -a FAILED_NAMES=()
+    declare -a FAILED_COMMANDS=()
 
     # Helper function to record test failure
     record_failure() {
         TESTS_PASSED=false
-        FAILED_TESTS="${FAILED_TESTS}"$'\n'"  - $1"
+        FAILED_NAMES+=("$1")
+        FAILED_COMMANDS+=("$2")
     }
 
     # -------------------------------------------------------------------------
@@ -215,7 +218,7 @@ release-test:
     else
         echo ""
         echo "✗ Unit tests FAILED"
-        record_failure "Unit tests with coverage"
+        record_failure "Unit tests with coverage" "just testing::cov"
     fi
     echo ""
 
@@ -233,7 +236,7 @@ release-test:
     else
         echo ""
         echo "✗ Headless integration tests FAILED"
-        record_failure "Headless integration tests"
+        record_failure "Headless integration tests" "just testing::integration-headless-release"
     fi
     echo ""
 
@@ -251,7 +254,7 @@ release-test:
     else
         echo ""
         echo "✗ GUI integration tests FAILED"
-        record_failure "GUI integration tests"
+        record_failure "GUI integration tests" "just testing::integration-gui-release"
     fi
     echo ""
 
@@ -269,7 +272,7 @@ release-test:
     else
         echo ""
         echo "✗ Docker integration test FAILED"
-        record_failure "Docker integration test"
+        record_failure "Docker integration test" "just docker::test"
     fi
     echo ""
 
@@ -287,7 +290,7 @@ release-test:
     else
         echo ""
         echo "✗ Just command tests FAILED"
-        record_failure "Just command tests"
+        record_failure "Just command tests" "just testing::just-all"
     fi
     echo ""
 
@@ -318,7 +321,23 @@ release-test:
     else
         echo "✗ SOME TESTS FAILED - Cannot proceed with release"
         echo ""
-        printf "Failed tests:%s\n" "$FAILED_TESTS"
+        echo "============================================================"
+        echo "  FAILED TESTS"
+        echo "============================================================"
+        echo ""
+        for i in "${!FAILED_NAMES[@]}"; do
+            echo "  ✗ ${FAILED_NAMES[$i]}"
+        done
+        echo ""
+        echo "============================================================"
+        echo "  TO RECREATE FAILURES"
+        echo "============================================================"
+        echo ""
+        echo "Run these commands to reproduce the failing tests:"
+        echo ""
+        for i in "${!FAILED_COMMANDS[@]}"; do
+            echo "  ${FAILED_COMMANDS[$i]}"
+        done
         echo ""
         echo "Please fix the failing tests before creating a release."
         exit 1