add security salt

app/tests/bootstrap.php

@@ -22,6 +22,7 @@
 use Cake\Database\Driver\Postgres;
 use Cake\Datasource\ConnectionManager;
 use Cake\TestSuite\ConnectionHelper;
+use Cake\Utility\Security;
 use Migrations\TestSuite\Migrator;
 
 /**
@@ -34,6 +35,14 @@
 
 require dirname(__DIR__) . '/config/bootstrap.php';
 
+// Ensure Security salt is set for tests (needed by CSRF middleware, hashes, etc).
+// In CI we inject it via env (COMANAGE_REGISTRY_SECURITY_SALT).
+if (!Security::getSalt()) {
+  $salt = getenv('COMANAGE_REGISTRY_SECURITY_SALT') ?: 'phpunit-security-salt';
+  Security::setSalt($salt);
+}
+
+
 if (empty($_SERVER['HTTP_HOST']) && !Configure::read('App.fullBaseUrl')) {
   Configure::write('App.fullBaseUrl', 'http://localhost');
 }