From 3221b05f523f9b76bf63a705bb1669f6d4d2976e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Eric=20Meadows-J=C3=B6nsson?= Date: Wed, 5 Aug 2026 21:55:17 +0200 Subject: [PATCH] Document the secret_scan package metadata field The repository's secret scanning of published packages reads this to suppress findings in paths a package deliberately ships secret-like values in. --- package_metadata.md | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/package_metadata.md b/package_metadata.md index 093c9fa..78e51a8 100644 --- a/package_metadata.md +++ b/package_metadata.md @@ -83,6 +83,17 @@ All keys are strings. Extra information about the package + + `secret_scan (kvlist(...)) (optional)` + + Configuration for the repository's secret scanning of the package. + + + `ignore (list(string)) (optional)` + + File path globs whose findings are suppressed. `*` matches within a + path segment, `**` spans separators, `?` matches one non-separator + character. Intended for paths a package deliberately ships secret-like + values in, such as test fixtures. + ### Optional dependencies An optional dependency will only be used if a package higher up the dependency chain also depends on it (only if that the dependency is not defined as optional as well).