From e29c784a5ab2da92129210af55c90890a8821ca5 Mon Sep 17 00:00:00 2001
From: Kayshen-X <kayshen_xu@163.com>
Date: Sun, 9 Aug 2026 23:19:29 +0800
Subject: [PATCH] fix(ci): treat default-filename cfg(test) modules as
 test-only source

The collab security-boundary scanner excludes external test modules
from its production-source checks, but only recognized the explicit
`#[cfg(test)] #[path = "..."] mod x;` form. A plain
`#[cfg(test)] mod production_check_tests;` (default filename) fell
through and its deterministic test signing seeds tripped the
"signing seed leaked into production source" rule. Resolve the default
`name.rs` / `name/mod.rs` sibling too. All 57 boundary mutation tests
still pass.
---
 tools/check-collab-security-boundaries.sh | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/tools/check-collab-security-boundaries.sh b/tools/check-collab-security-boundaries.sh
index c7e22a561..dbb80e299 100644
--- a/tools/check-collab-security-boundaries.sh
+++ b/tools/check-collab-security-boundaries.sh
@@ -99,6 +99,16 @@ cfg_test_external_module_files() {
             cfg_test && /^[[:space:]]*(pub(\([^)]*\))?[[:space:]]+)?mod[[:space:]]+[A-Za-z_][A-Za-z0-9_]*[[:space:]]*;[[:space:]]*$/ {
                 if (module_path != "") {
                     print module_path
+                } else {
+                    # No #[path]: a `#[cfg(test)] mod name;` resolves to its
+                    # default sibling file, `name.rs` (or `name/mod.rs`).
+                    # Emit both so either layout is recognized as a test-only
+                    # module rather than scanned as production source.
+                    name = $0
+                    sub(/^[[:space:]]*(pub(\([^)]*\))?[[:space:]]+)?mod[[:space:]]+/, "", name)
+                    sub(/[[:space:]]*;.*$/, "", name)
+                    print name ".rs"
+                    print name "/mod.rs"
                 }
                 reset_attributes()
                 next