fix(security): détecter les PIN Pronote littéraux

tests/unit/test_check_secrets.py

@@ -236,6 +236,58 @@ def test_main_detects_prefixed_secret_assignment(
     assert sentinel not in output
 
 
+def test_main_detects_pronote_pin_assignments_without_disclosing_value(
+    secret_checker: ModuleType, tmp_path: Path, capsys: CaptureFixture[str]
+) -> None:
+    """Détecte les PIN Pronote littéraux et non quotés sans afficher leur valeur.
+
+    :param secret_checker: Module du script sous test.
+    :param tmp_path: Répertoire temporaire représentant un dépôt.
+    :param capsys: Fixture de capture de sortie.
+    :return: None
+    """
+    literal_pin = "pin-literal-sentinel"
+    unquoted_pin = "pin-unquoted-sentinel"
+    (tmp_path / "settings.py").write_text(f'PRONOTE_QR_PIN = "{literal_pin}"\n', encoding="utf-8")
+    (tmp_path / "settings.yaml").write_text(
+        f"PRONOTE_ACCOUNT_PIN: {unquoted_pin}\n", encoding="utf-8"
+    )
+
+    assert secret_checker.main([], root=tmp_path) == 1
+    output = capsys.readouterr().out
+    assert "settings.py:1" in output
+    assert "settings.yaml:1" in output
+    assert literal_pin not in output
+    assert unquoted_pin not in output
+
+
+@pytest.mark.parametrize(
+    "line",
+    [
+        'PRONOTE_QR_PIN = "<valeur>"',
+        "# PRONOTE_ACCOUNT_PIN doit rester dans le fichier d'environnement local",
+    ],
+)
+def test_main_ignores_pronote_pin_placeholders_and_descriptions(
+    secret_checker: ModuleType,
+    tmp_path: Path,
+    capsys: CaptureFixture[str],
+    line: str,
+) -> None:
+    """Ignore les placeholders et descriptions de PIN sans affectation réelle.
+
+    :param secret_checker: Module du script sous test.
+    :param tmp_path: Répertoire temporaire représentant un dépôt.
+    :param capsys: Fixture de capture de sortie.
+    :param line: Ligne documentaire à analyser.
+    :return: None
+    """
+    (tmp_path / "guide.py").write_text(line + "\n", encoding="utf-8")
+
+    assert secret_checker.main([], root=tmp_path) == 0
+    assert "OK:" in capsys.readouterr().out
+
+
 def test_main_detects_short_secret_assignment(
     secret_checker: ModuleType, tmp_path: Path, capsys: CaptureFixture[str]
 ) -> None: