Ignore hidden entries during secrets bootstrap

internal/engine/secrets_test.go

@@ -64,6 +64,41 @@ func TestLoadSecretsDirLoadsCanonicalSortedValues(t *testing.T) {
 	}
 }
 
+func TestLoadSecretsDirIgnoresDotEntries(t *testing.T) {
+	directory := t.TempDir()
+	if err := os.Mkdir(filepath.Join(directory, ".git"), 0o700); err != nil {
+		t.Fatal(err)
+	}
+	writeSecretTestFile(t, directory, ".gitignore", "CANARY\x00")
+	writeSecretTestFile(t, directory, ".DS_Store", "CANARY\x00")
+	if runtime.GOOS != "windows" {
+		if err := os.Symlink(filepath.Join(directory, "missing"), filepath.Join(directory, ".hidden-link")); err != nil {
+			t.Fatal(err)
+		}
+	}
+	access := testSecretsAccess()
+	access.lstat = func(path string) (fs.FileInfo, error) {
+		if strings.HasPrefix(filepath.Base(path), ".") {
+			t.Fatalf("inspected ignored entry %q", path)
+		}
+		return os.Lstat(path)
+	}
+	environment := map[string]string{}
+	report, err := loadSecretsDir(directory, mapSecretsEnvironment(environment), access)
+	if err != nil || len(report.Entries()) != 0 || len(environment) != 0 {
+		t.Fatalf("hidden-only directory: error = %v, report = %#v, environment = %#v", err, report.Entries(), environment)
+	}
+	writeSecretTestFile(t, directory, "SECRET", "value\n")
+	report, err = loadSecretsDir(directory, mapSecretsEnvironment(environment), access)
+	if err != nil {
+		t.Fatal(err)
+	}
+	want := []SecretFileResult{{Name: "SECRET", Path: filepath.Join(canonicalTestPath(t, directory), "SECRET"), Status: SecretFileLoaded}}
+	if !reflect.DeepEqual(report.Entries(), want) || !reflect.DeepEqual(environment, map[string]string{"SECRET": "value"}) {
+		t.Fatalf("mixed directory: report = %#v, environment = %#v", report.Entries(), environment)
+	}
+}
+
 func TestLoadSecretsDirPreservesExistingWithoutReading(t *testing.T) {
 	directory := t.TempDir()
 	writeSecretTestFile(t, directory, "EMPTY_WINNER", strings.Repeat("CANARY", int(secretFileByteLimit)))