Allow a secret_scan package metadata key

[ericmj]

Adds :secret_scan to the package metadata carried into the tarball, so hexpm's credential scanner can read a per-package ignore list:

package: [
  secret_scan: [ignore: ["test/fixtures/**", "priv/certs/*.pem"]]
]

Documented in Hex.Package.configuration_doc/0. Companion to the hexpm scanner and the field definition in the specifications repo.

Companion PRs: hexpm/hexpm#1806, hexpm/specifications#77

[maennchen]

This fails when actually building a package:

mix hex.build
Building foo 0.1.0
  App: foo
  Name: foo
  Files:
    lib
    lib/foo.ex
    .formatter.exs
    mix.exs
    README.md
  Version: 0.1.0
  Build tools: mix
  Description: A simple Elixir project
  Licenses: MIT
  Links:

  Elixir: ~> 1.18
** (Protocol.UndefinedError) protocol String.Chars not implemented for type Tuple

Got value:

    {:ignore, ["test/fixtures/hexpm/secret_scan.exs"]}

    (elixir 1.18.4) lib/string/chars.ex:3: String.Chars.impl_for!/1
    (elixir 1.18.4) lib/string/chars.ex:22: String.Chars.to_string/1
    (elixir 1.18.4) lib/enum.ex:4192: Enum.join_non_empty_list/3
    (elixir 1.18.4) lib/enum.ex:4468: Enum.join_list/2
    (hex 2.5.2-dev) lib/mix/tasks/hex.build.ex:365: Mix.Tasks.Hex.Build.print_metadata/2
    (elixir 1.18.4) lib/enum.ex:987: Enum."-each/2-lists^foreach/1-0-"/2
    (hex 2.5.2-dev) lib/mix/tasks/hex.build.ex:134: Mix.Tasks.Hex.Build.print_info/4
    (hex 2.5.2-dev) lib/mix/tasks/hex.build.ex:58: Mix.Tasks.Hex.Build.run/1
    (mix 1.18.4) lib/mix/task.ex:495: anonymous fn/3 in Mix.Task.run_task/5
    (mix 1.18.4) lib/mix/cli.ex:107: Mix.CLI.run_task/2
    /nix/store/h24wnnw20qiaixfjf29fm9vlywfz3f52-elixir-1.18.4/bin/mix:2: (file)
    (elixir 1.18.4) lib/code.ex:1525: Code.require_file/2

mix.exs:

defmodule Foo.MixProject do
  use Mix.Project

  def project do
    [
      app: :foo,
      description: "A simple Elixir project",
      version: "0.1.0",
      elixir: "~> 1.18",
      start_permanent: Mix.env() == :prod,
      deps: deps(),
      package: [
        secret_scan: [
          ignore: [
            "test/fixtures/hexpm/secret_scan.exs"
          ]
        ],
        licenses: ["MIT"],
        links: %{}
      ]
    ]
  end

  # Run "mix help compile.app" to learn about applications.
  def application do
    [
      extra_applications: [:logger]
    ]
  end

  # Run "mix help deps" to learn about dependencies.
  defp deps do
    [
      # {:dep_from_hexpm, "~> 0.3.0"},
      # {:dep_from_git, git: "https://github.com/elixir-lang/my_dep.git", tag: "0.1.0"}
    ]
  end
end