Test: Harden compose secret fixtures

tests/server/compose-secrets-contract

@@ -33,15 +33,26 @@ if ! python3 "$scanner" "$fixtures_dir/clean" compose.yml .env.example README.md
     note 'the clean secret-scanning fixture was rejected'
 fi
 
-for fixture in compose.yml .env.example; do
-    if output="$(python3 "$scanner" "$fixtures_dir/leaked" "$fixture" 2>&1)"; then
-        note "the leaked $fixture fixture was accepted"
-    elif [[ "$fixture" == compose.yml && "$output" != *'POSTGRES_PASSWORD'* ]]; then
-        note 'the leaked compose fixture did not name POSTGRES_PASSWORD'
-    elif [[ "$fixture" == .env.example && "$output" != *'API_TOKEN'* ]]; then
-        note 'the leaked env fixture did not name API_TOKEN'
+expect_leak() {
+    local fixture="$1"
+    local expected="$2"
+    local output
+    local status
+
+    output="$(python3 "$scanner" "$fixtures_dir/leaked" "$fixture" 2>&1)"
+    status=$?
+    if (( status != 1 )); then
+        note "the leaked $fixture fixture exited $status instead of 1"
+    elif [[ "$output" != "$expected" ]]; then
+        note "the leaked $fixture fixture reported '$output' instead of '$expected'"
     fi
-done
+}
+
+expect_leak compose.yml 'compose.yml:4: POSTGRES_PASSWORD'
+expect_leak .env.example '.env.example:1: API_TOKEN'
+expect_leak plain-list.yml 'plain-list.yml:4: API_TOKEN'
+expect_leak quoted-mapping.yml 'quoted-mapping.yml:4: API_TOKEN'
+expect_leak quoted-list.yml 'quoted-list.yml:4: API_TOKEN'
 
 mapfile -t tracked_server_files < <(git -C "$repo_dir" ls-files 'server/**' 'server/*')
 if ! output="$(python3 "$scanner" "$repo_dir" "${tracked_server_files[@]}" 2>&1)"; then