A macOS test drives /usr/bin/security through Keychain::with_tool and a wrapper
that names a scratch keychain on every command it passes on: an item kept, read
back, replaced through -U and removed, no secret on any process argument, exit
44 read as none. It removes the scratch keychain in every case, a failure
included, and holds the search list and the default keychain to what they were.
It never names the login keychain, and needs no dialog.
What the real tool does that the stand-in did not: security -i exits with the
status of a command that failed in it, where the stand-in always exited 0. add
now reports that status and what the tool said, with any secret removed from
it, rather than reading it as "holds another secret". The stand-in does the same
now.
wai-key-keychain.yml runs this test alone on the macOS runner, for a pull
request whose own diff changes dx/key.rs or the workflow.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
4ec3d5fa6f