fix(security): move hardcoded test password to GitHub Actions secret

- CI workflow: PVE_PASSWORD now reads from secrets.PVE_TEST_PASSWORD
- variables.tf: removed default password, requires TF_VAR env var
- Integration README: examples use <your-test-password> placeholder
- create-api-token.sh: example IP changed to pve.example.com
- .gitignore: added .env/.env.* exclusion

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.github/workflows/integration-tests.yml

@@ -43,7 +43,7 @@ permissions:
 env:
   INFRA_DIR: tests/infrastructure
   SCRIPTS_DIR: tests/infrastructure/scripts
-  PVE_PASSWORD: "Testpass123!"
+  PVE_PASSWORD: ${{ secrets.PVE_TEST_PASSWORD }}
   TEST_IMAGE: ghcr.io/goodolclint/psproxmoxve-integration
   CACHE_DIR: /opt/pve-isos
 

.gitignore

@@ -11,3 +11,5 @@ nupkg/
 *.ps1xml.bak
 *.DotSettings.user
 BenchmarkDotNet.Artifacts/
+.env
+.env.*

tests/PSProxmoxVE.Tests/Integration/README.md

@@ -66,7 +66,7 @@ required variable causes every integration test to be skipped with a clear reaso
 | `PVETEST_NODE`           | Yes      | Node name as it appears in `pvesh get /nodes`                        | `pve-test1`                                         |
 | `PVETEST_STORAGE`        | Yes      | Storage pool to use for disk and ISO operations                       | `local`                                             |
 | `PVETEST_ISO_PATH`       | Yes      | Local path to a small `.iso` file used for upload tests               | `/tmp/tinycorelinux.iso`                            |
-| `PVETEST_PASSWORD`       | No       | Root password for cloud-init Linux VM provisioning                    | `Testpass123!`                                      |
+| `PVETEST_PASSWORD`       | No       | Root password for cloud-init Linux VM provisioning                    | *(use a strong password)*                           |
 | `PVETEST_CLOUD_IMAGE_URL`| No      | URL for cloud image download (defaults to Ubuntu Noble)               | `https://cloud-images.ubuntu.com/noble/current/noble-server-cloudimg-amd64.img` |
 | `PVETEST_PVE_VERSION`    | No       | Expected PVE major version (8 or 9)                                   | `9`                                                 |
 
@@ -80,7 +80,7 @@ export PVETEST_NODE="pve-test1"
 export PVETEST_STORAGE="local"
 export PVETEST_ISO_PATH="/tmp/tinycorelinux.iso"
 # Optional — required for Linux VM provisioning tests
-export PVETEST_PASSWORD="Testpass123!"
+export PVETEST_PASSWORD="<your-test-password>"
 ```
 
 ### Setting variables (PowerShell)
@@ -93,7 +93,7 @@ $env:PVETEST_NODE      = 'pve-test1'
 $env:PVETEST_STORAGE   = 'local'
 $env:PVETEST_ISO_PATH  = '/tmp/tinycorelinux.iso'
 # Optional — required for Linux VM provisioning tests
-$env:PVETEST_PASSWORD  = 'Testpass123!'
+$env:PVETEST_PASSWORD  = '<your-test-password>'
 ```
 
 ### GitHub Actions / CI

tests/infrastructure/scripts/create-api-token.sh

@@ -3,7 +3,7 @@
 # then wait for the PVE API and create an API token.
 #
 # Usage: create-api-token.sh <parent-pve-endpoint> <parent-api-token> <vm-id> <root-password> [max-wait-seconds]
-#   parent-pve-endpoint: Full URL e.g. https://172.16.100.150:8006
+#   parent-pve-endpoint: Full URL e.g. https://pve.example.com:8006
 #   Outputs two lines:
 #     IP=<discovered-ip>
 #     TOKEN=root@pam!integration=<secret>

tests/infrastructure/variables.tf

@@ -66,8 +66,7 @@ variable "network_bridge" {
 }
 
 variable "test_vm_password" {
-  description = "Root password for the nested PVE instances"
+  description = "Root password for the nested PVE instances. Set via TF_VAR_test_vm_password env var."
   type        = string
   sensitive   = true
-  default     = "Testpass123!"
 }