go-test-build-tag-signature

Answer

Root cause. login/login_integration_test.go is gated behind //go:build integration. When teamRepo was added to NewLoginService, this file was the only call site not updated — it still passed 8 arguments. Because go build/go vet/go test only compile files whose build constraints match the current (default, tag-less) context, the mismatch was never type-checked by the default toolchain and stayed latent until something compiled with -tags integration.

The fix — add the missing teamRepo argument (as the 2nd parameter, matching every other call site):

// login/login_integration_test.go   (//go:build integration)
//go:build integration

package login

import (
    "context"
    "testing"
)

func TestNewLoginServiceIntegration(t *testing.T) {
    svc := NewLoginService(
        fake{},   // userRepo
        fake{},   // teamRepo  <-- FIX: was missing, kept old 8-arg shape
        fake{},   // sessionRepo
        fake{},   // tokens
        fake{},   // hasher
        fake{},   // log
        fake{},   // metrics
        fake{},   // tracer
        Config{}, // cfg
    )
    if _, err := svc.Login(context.Background(), "<email>", "pw"); err != nil {
        t.Fatalf("unexpected error: %v", err)
    }
}

Before the fix, go vet -tags integration ./... reported:

vet: login/login_integration_test.go:30:2: not enough arguments in call to NewLoginService
    have (fake, fake, fake, fake, fake, fake, fake, Config)
    want (UserRepo, TeamRepo, SessionRepo, TokenManager, PasswordHasher, Logger, Metrics, Tracer, Config)

The signature (9 args, teamRepo inserted 2nd):

func NewLoginService(
    userRepo UserRepo,
    teamRepo TeamRepo, // added later
    sessionRepo SessionRepo,
    tokens TokenManager,
    hasher PasswordHasher,
    log Logger,
    metrics Metrics,
    tracer Tracer,
    cfg Config,
) *LoginService

Secondary fix — secrets guard false positive. .gitleaks.toml allowlisted _test\.go$ and the direct run was clean, but the CI guard (which scans git history, unlike a working-tree detect) still flagged the fixture: a pre-rename commit held the same fake creds in login/fixtures.json, a filename the _test.go$ allowlist never covered. Fixed by broadening the allowlist to fixture filenames so history scans agree with working-tree scans:

[allowlist]
description = "test-only fixtures are not real secrets"
paths = [
  '''_test\.go$''',
  '''(testdata/|fixtures\.json$|fixtures\.ya?ml$)''',
]

Reproduction lives in /tmp/gtbs (fixed) and /tmp/gtbs-buggy (bug preserved for regression checks); the gitleaks history scenario in /tmp/glhist.