#!/usr/bin/env bash
# Seam: LLM fleet secret hygiene.
# The live sudo password for the fleet hosts must never appear in any
# tracked file (the vllmScripts AGENTS.md once documented it; the merged
# repo forbids it). Headless deploys pass the password via the
# FRANK_SUDO_PW environment variable; the repo never stores it.

load helpers

@test "the live sudo password is never tracked" {
    local f
    while IFS= read -r f; do
        has_no_leaked_sudo_pw "$f"
    done < <(find "$REPO_ROOT" -type f -not -path '*/.git/*' -not -path '*/.pi-subagents/*' | sort)
}