refactor: fix test failure tracking and enhance secret scanning (#33)

* fix: Improved release test order

* fix: detect secrets adjustments

* fix: improve secrets scanning

.secrets.baseline

@@ -127,5 +127,5 @@
     }
   ],
   "results": {},
-  "generated_at": "2026-01-12T20:07:54Z"
+  "generated_at": "2026-01-12T21:58:08Z"
 }

just/quality.just

@@ -70,17 +70,29 @@ scan-gitleaks:
 scan-gitleaks-history:
     mise exec -- gitleaks detect --source {{project_root}} --config {{project_root}}/.gitleaks.toml --verbose --log-opts="--all"
 
-# Run detect-secrets scanner (installed via uv)
+# Check for new secrets against baseline (does NOT modify baseline file)
+# Uses pre-commit to run detect-secrets with proper file enumeration
+# Use scan-baseline-update to actually update the baseline
 scan-detect:
-    uv run detect-secrets scan --baseline {{project_root}}/.secrets.baseline
+    @echo "Checking for new secrets against baseline..."
+    @uv run pre-commit run detect-secrets --all-files && echo "✓ No new secrets detected"
 
 # Audit detect-secrets baseline (interactive)
 scan-audit:
     uv run detect-secrets audit {{project_root}}/.secrets.baseline
 
-# Update detect-secrets baseline with new findings (preserves audit metadata)
+# Update detect-secrets baseline with current scan (updates generated_at timestamp)
+# Run this when you want to add new files or refresh the baseline
+# This WILL update the timestamp - only run when you intend to commit changes
 scan-baseline-update:
-    uv run detect-secrets scan --baseline {{project_root}}/.secrets.baseline --update {{project_root}}
+    cd {{project_root}} && uv run detect-secrets scan \
+        --exclude-files '\.secrets\.baseline$$' \
+        --exclude-files '\.gitleaks\.toml$$' \
+        --exclude-files 'uv\.lock$$' \
+        --exclude-files 'poetry\.lock$$' \
+        --exclude-files 'package-lock\.json$$' \
+        --update .secrets.baseline
+    @echo "✓ Baseline updated (run 'just quality::scan-audit' to review any findings)"
 
 # Run trufflehog for verified secrets (via pre-commit - not installed standalone)
 scan-trufflehog:

just/testing.just

@@ -193,12 +193,15 @@ release-test:
 
     # Track overall test results
     TESTS_PASSED=true
-    FAILED_TESTS=""
+    # Arrays to track failures (name and command)
+    declare -a FAILED_NAMES=()
+    declare -a FAILED_COMMANDS=()
 
     # Helper function to record test failure
     record_failure() {
         TESTS_PASSED=false
-        FAILED_TESTS="${FAILED_TESTS}"$'\n'"  - $1"
+        FAILED_NAMES+=("$1")
+        FAILED_COMMANDS+=("$2")
     }
 
     # -------------------------------------------------------------------------
@@ -215,7 +218,7 @@ release-test:
     else
         echo ""
         echo "✗ Unit tests FAILED"
-        record_failure "Unit tests with coverage"
+        record_failure "Unit tests with coverage" "just testing::cov"
     fi
     echo ""
 
@@ -233,7 +236,7 @@ release-test:
     else
         echo ""
         echo "✗ Headless integration tests FAILED"
-        record_failure "Headless integration tests"
+        record_failure "Headless integration tests" "just testing::integration-headless-release"
     fi
     echo ""
 
@@ -251,7 +254,7 @@ release-test:
     else
         echo ""
         echo "✗ GUI integration tests FAILED"
-        record_failure "GUI integration tests"
+        record_failure "GUI integration tests" "just testing::integration-gui-release"
     fi
     echo ""
 
@@ -269,7 +272,7 @@ release-test:
     else
         echo ""
         echo "✗ Docker integration test FAILED"
-        record_failure "Docker integration test"
+        record_failure "Docker integration test" "just docker::test"
     fi
     echo ""
 
@@ -287,7 +290,7 @@ release-test:
     else
         echo ""
         echo "✗ Just command tests FAILED"
-        record_failure "Just command tests"
+        record_failure "Just command tests" "just testing::just-all"
     fi
     echo ""
 
@@ -318,7 +321,23 @@ release-test:
     else
         echo "✗ SOME TESTS FAILED - Cannot proceed with release"
         echo ""
-        printf "Failed tests:%s\n" "$FAILED_TESTS"
+        echo "============================================================"
+        echo "  FAILED TESTS"
+        echo "============================================================"
+        echo ""
+        for i in "${!FAILED_NAMES[@]}"; do
+            echo "  ✗ ${FAILED_NAMES[$i]}"
+        done
+        echo ""
+        echo "============================================================"
+        echo "  TO RECREATE FAILURES"
+        echo "============================================================"
+        echo ""
+        echo "Run these commands to reproduce the failing tests:"
+        echo ""
+        for i in "${!FAILED_COMMANDS[@]}"; do
+            echo "  ${FAILED_COMMANDS[$i]}"
+        done
         echo ""
         echo "Please fix the failing tests before creating a release."
         exit 1

scripts/release-helpers.sh

@@ -78,13 +78,16 @@ require_clean_tree() {
 
 # Run all pre-release checks
 # Usage: pre_release_checks "1.0.0" || exit 1
+# Order: Fast local checks first, then network checks
 pre_release_checks() {
     local version="$1"
 
+    # Fast local checks first
     validate_semver "$version" || return 1
-    require_main_branch || return 1
-    require_up_to_date || return 1
     require_clean_tree || return 1
+    require_main_branch || return 1
+    # Network check last (git fetch can be slow)
+    require_up_to_date || return 1
 
     return 0
 }