---
id: w2/m9/t008
title: Test coverage — token refresh, expired-token failure, two-key webhook, autoDeploy gate
worker: worker2
status: done
estimate: 40m
depends_on: [w2/m9/t006]
---

## Objective

Standing closing task. Add meaningful tests for m9's behavior and failure modes beyond what t001–t004 shipped inline.

## Context

- Highest-value coverage: clone Secret refreshed (not duplicated) on repeat deploys; expired/unmintable token surfaces a clean error, never a silent public-clone attempt of a private repo; webhook accepts either key and rejects both-invalid; non-push GitHub events are 200 no-ops; `autoDeploy: false` suppresses webhook redeploy (existing test — extend for the GitHub-key path); operator Job spec with/without `cloneSecret` (envtest).

## Steps

1. Inventory inline coverage; fill the gaps above.
2. `cd lego/backend && go test ./...` and `make test` (from `lego/operator/`) green.

## Files

- `lego/backend/internal/apps/*_test.go`, `lego/operator/internal/build/*_test.go`

## Acceptance criteria

- [ ] Each failure mode above has a test that regresses loudly

## Out of scope

- Live-cluster automation (t005 covered it manually)
