Function public_text 

pub fn public_text(
    text: &str,
    root: &Path,
    home: Option<&Path>,
) -> Result<Redacted, String>

Text fit to publish: machine paths normalised, then credentials redacted, then checked.

A redaction covers what its shape matched, and two shapes match less than the secret they announce. So the text is refused, with what it carries and never the text, when:

• its markers name a private key’s header, whose body follows on the lines after it, or an access key id, whose secret access key no shape matches. The markers are read off the text, so a text redacted once already is refused as the original would be. Redacting the announcement removes the very marker generate::forbidden_in refuses on, and would publish the rest;
• it still holds a private key’s armour line, such as the footer a failure’s tail keeps after cutting the header off, or a secret access key assigned a value: a secret whose announcement no longer is in the text, or never was;
• generate::forbidden_in, the check every published artifact already passes, still finds a marker: something neither rule can make safe, such as another account’s home directory or a bearer header too short to be a credential’s shape.

use majordomus_cli::redaction::public_text;

let dir = tempfile::tempdir().unwrap();
let key = format!("{}{}", "xoxb-", "e".repeat(12));
let text = format!("{}/target: {key}", dir.path().display());
let out = public_text(&text, dir.path(), None).unwrap();
assert_eq!(out.text, "<repo>/target: [redacted:slack-token]");

let elsewhere = format!("{}{}", "/ho", "me/someone/.cache");
let refused = public_text(&elsewhere, dir.path(), None).unwrap_err();
assert!(refused.contains("an absolute path on the machine"));

let pem = format!("{}{}\n{}", "-----BEGIN ", "PRIVATE KEY-----", "f".repeat(64));
let refused = public_text(&pem, dir.path(), None).unwrap_err();
assert!(refused.contains("`private-key-header`"));

let tail = format!("{}\n{}{}", "g".repeat(64), "-----END ", "PRIVATE KEY-----");
let refused = public_text(&tail, dir.path(), None).unwrap_err();
assert!(refused.contains("`PRIVATE KEY-----`"));