From 567b9db04dce68779014400f0ff43a54f3395a76 Mon Sep 17 00:00:00 2001
From: Ravi Tharuma <25951435+RaviTharuma@users.noreply.github.com>
Date: Thu, 20 Aug 2026 12:32:11 +0200
Subject: [PATCH] test(ci): lock env-doc-sync ignore for ad-hoc
 BOT_TOKEN/BOT_URL

Drive runEnvDocSync so BOT_TOKEN/BOT_URL are ignored by IGNORE_FROM_CODE and flagged when ignore is empty.
---
 tests/unit/check-env-doc-sync.test.ts | 26 ++++++++++++++++++++++++++
 1 file changed, 26 insertions(+)

diff --git a/tests/unit/check-env-doc-sync.test.ts b/tests/unit/check-env-doc-sync.test.ts
index 2db6a62c87..3975e58361 100644
--- a/tests/unit/check-env-doc-sync.test.ts
+++ b/tests/unit/check-env-doc-sync.test.ts
@@ -179,6 +179,32 @@ test("runEnvDocSync: ignore set skips a code-referenced var", () => {
   assert.equal(result.ok, true);
 });
 
+test("runEnvDocSync: shipped allowlist ignores ad-hoc BOT_TOKEN and BOT_URL", () => {
+  const envExampleText = `JWT_SECRET=secret\n`;
+  const envDocText = "| `JWT_SECRET` | _(none)_ | required |";
+  const codeVars = new Set(["JWT_SECRET", "BOT_TOKEN", "BOT_URL"]);
+
+  const unignored = runEnvDocSync({
+    envExampleText,
+    envDocText,
+    codeVars,
+    ignore: new Set(),
+    docOnlyAllowlist: new Set(),
+    envOnlyAllowlist: new Set(),
+  });
+  assert.equal(unignored.ok, false);
+  assert.deepEqual(unignored.problems.codeMissingEnv, ["BOT_TOKEN", "BOT_URL"]);
+
+  // Omit `ignore` so the checker uses IGNORE_FROM_CODE from check-env-doc-sync.mjs.
+  const shipped = runEnvDocSync({
+    envExampleText,
+    envDocText,
+    codeVars,
+  });
+  assert.equal(shipped.ok, true);
+  assert.deepEqual(shipped.problems.codeMissingEnv, []);
+});
+
 test("repository contract is in sync (live data)", () => {
   // Uses the real .env.example, docs/ENVIRONMENT.md, and the bundled
   // allowlists. This is the same check that runs in pre-commit / CI.