From f03c255263521359afded08aba2242bc2c817b5c Mon Sep 17 00:00:00 2001
From: Phil Leggetter <phil@leggetter.co.uk>
Date: Mon, 14 Sep 2026 18:43:36 +0100
Subject: [PATCH] chore: delete a test script containing a committed API key

test-scripts/test-api-upsert-behavior.sh hardcoded a live Hookdeck project
API key on line 11 and used it to authenticate three calls to api.hookdeck.com.
It was committed on 2025-10-29 and has been public since, across main,
release/v3.0.0, 24 of 29 remote branches and 44 tags whose source tarballs
carry it.

The key has been revoked, so the string is inert. Deleting rather than
parameterising: nothing references this script -- no workflow, no package.json
entry, no Makefile target -- and what it probes (whether source and destination
are required when updating a connection) is covered properly by the upsert
cases in test/acceptance/connection_test.go. Keeping it would mean keeping a
file whose remaining purpose is to hold a credential.

History is not rewritten. Once the key is revoked the committed string has no
value, and purging it would mean rewriting main plus 44 tags and force-pushing
a public repository -- a bigger and riskier change than the exposure now
warrants.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BnrKWZQASV7bFJ4oGWwmo9
---
 test-scripts/test-api-upsert-behavior.sh | 59 ------------------------
 1 file changed, 59 deletions(-)
 delete mode 100755 test-scripts/test-api-upsert-behavior.sh

diff --git a/test-scripts/test-api-upsert-behavior.sh b/test-scripts/test-api-upsert-behavior.sh
deleted file mode 100755
index 6f6c329f..00000000
--- a/test-scripts/test-api-upsert-behavior.sh
+++ /dev/null
@@ -1,59 +0,0 @@
-#!/bin/bash
-
-# Test script to verify Hookdeck API upsert behavior
-# Tests whether source/destination are required when updating a connection
-
-set -e
-
-echo "Testing API behavior for connection upsert..."
-
-# Get API key from test env file
-HOOKDECK_API_KEY="2pa5f5oeqbcgj91tipwlob0n5h7bg1ptd1nxodx5wgw05b51s8"
-
-# Generate unique name
-CONN_NAME="test-api-behavior-$(date +%s)"
-
-echo ""
-echo "=== Step 1: Creating connection with source and destination ==="
-CREATE_RESPONSE=$(curl -s -X PUT "https://api.hookdeck.com/2025-07-01/connections" \
-  -H "Authorization: Bearer $HOOKDECK_API_KEY" \
-  -H "Content-Type: application/json" \
-  -d "{
-    \"name\": \"$CONN_NAME\",
-    \"description\": \"Initial description\",
-    \"source\": {
-      \"name\": \"test-source-$CONN_NAME\",
-      \"type\": \"WEBHOOK\"
-    },
-    \"destination\": {
-      \"name\": \"test-dest-$CONN_NAME\",
-      \"type\": \"MOCK_API\"
-    }
-  }")
-
-echo "$CREATE_RESPONSE" | jq -r '{id: .id, name: .name, description: .description, source: .source.name, destination: .destination.name}'
-
-CONN_ID=$(echo "$CREATE_RESPONSE" | jq -r '.id')
-
-echo ""
-echo "=== Step 2: Updating ONLY description (no source/destination in request) ==="
-UPDATE_RESPONSE=$(curl -s -X PUT "https://api.hookdeck.com/2025-07-01/connections" \
-  -H "Authorization: Bearer $HOOKDECK_API_KEY" \
-  -H "Content-Type: application/json" \
-  -d "{
-    \"name\": \"$CONN_NAME\",
-    \"description\": \"Updated description WITHOUT source/destination\"
-  }")
-
-echo ""
-echo "Response:"
-echo "$UPDATE_RESPONSE" | jq '.'
-
-echo ""
-echo "=== Step 3: Cleanup ==="
-curl -s -X DELETE "https://api.hookdeck.com/2025-07-01/connections/$CONN_ID" \
-  -H "Authorization: Bearer $HOOKDECK_API_KEY" > /dev/null
-
-echo "Deleted connection $CONN_ID"
-echo ""
-echo "Test complete!"
\ No newline at end of file