[efraespada]

Credential health checks now send provider authentication through curl stdin, preventing secrets from appearing in process arguments or Google request URLs. The change preserves opt-in checks while rejecting invalid credentials and blocking redirects that could forward sensitive headers.

What changed

• Updated both credential health workflows to pass authentication headers through stdin, disable curlrc, and reject CR/LF credentials before requests.
• Kept Cursor Basic authentication and moved Google API key authentication to the x-goog-api-key header; requests remain HTTPS-only, bounded, and redirect-blocked.
• Updated the trusted workflow SHA-256 pin and documented the transport behavior and operator guidance.
• Added regression coverage using a fake curl boundary for authentication transport, argv exposure, invalid credentials, endpoint selection, and failure propagation.

Validation

• Author-provided evidence reports 82 new regression cases using fake curl without real credentials or network.
• Author-provided evidence reports 712 suites and 11,985 tests passed, with type, lint, build, and workflow, documentation, and specification validators passing.

Review notes

• The issue also calls for updating six existing consumer workflows. This diff updates the setup template and dogfooding workflow; consumer updates are not shown here.

[docs-page]

To preview the documentation for this pull request, visit the following URL:

docs.page/vypdev/copilot~683

Documentation is deployed and generated using docs.page

[vypbot]

Bugbot: review complete

Current status: No active findings on e829848.

Pull request · Verified commit · Workflow run

[vypbot]

Copilot approval · Human review needed

Status: This pull request is outside the configured approval scope.
Completed: 1/1 observed checks succeeded; Bugbot complete.
Action required: Ask a human reviewer to decide.
Impact: No new approval is confirmed for this revision.
See checks

Technical evidence

Revision: e8298485c3a4; base: 5721ec711e1b; reason: scope.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.14%. Comparing base (274db40) to head (e829848).
⚠️ Report is 1642 commits behind head on develop.

Additional details and impacted files

@@             Coverage Diff             @@
##           develop     #683      +/-   ##
===========================================
+ Coverage    90.94%   94.14%   +3.19%     
===========================================
  Files          135      974     +839     
  Lines         6251    31653   +25402     
  Branches      1338     9296    +7958     
===========================================
+ Hits          5685    29799   +24114     
- Misses         172      707     +535     
- Partials       394     1147     +753     

Files with missing lines	Coverage Δ
...c/infrastructure/setup_permission_actions_probe.ts	99.16% <100.00%> (ø)

... and 1040 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.