Add safe Postgres credential rotation

backend/tests/test_rc_backup_restore_scripts.py

@@ -75,3 +75,17 @@ def test_readiness_gate_checks_release_safety_scripts() -> None:
         "restore_release_backup_smoke.sh",
     ):
         assert f"bash -n scripts/{name}" in readiness
+
+
+def test_password_rotation_never_prints_or_persists_generated_secret() -> None:
+    script = read("rotate_postgres_password.sh")
+
+    assert "openssl rand -hex 32" in script
+    assert 'echo "$NEW_PASSWORD"' not in script
+    assert 'printf "%s" "$NEW_PASSWORD"' not in script
+    assert "GEOINTEL_ROTATED_DATABASE_PASSWORD" in script
+    assert "NamedTemporaryFile" in script
+    assert "temporary.replace(path)" in script
+    assert "ALTER ROLE %s PASSWORD" in script
+    assert "run-dockerman-container.sh" in script
+    assert "/health/ready" not in script