The docs deploy (failing preview) fails on two separate problems. The Netlify project is configured entirely in the UI, so neither was visible from the repository.
1. Secrets scanning blocks the build
Error message
Secrets scanning found secrets in build.
Build failed due to a user error: Build script returned non-zero exit code: 2It flags five lines in four test files:
| File | What the fixture is for |
|---|---|
test/ai-provider.test.ts:540 | asserts redactDeep() masks an sk-ant- key |
test/analysis-engine.test.ts:37 | asserts the analyzer flags a ghp_ token in source |
test/github-provider-api.test.ts:104 | asserts an error message does not leak a token |
test/review-parity.test.ts:19,214 | asserts a review finds a token in a diff |
No real credential is exposed. Every value is synthetic: abcdefghijklmnopqrstuv, ABCDEFGHIJKLMNOPQRST12345, 0123456789abcdefghij…. I checked each line before touching anything.
They also cannot be softened. Four of the five are fixtures for tests whose entire purpose is secret detection and redaction, so a token that does not look like a token makes the test assert nothing. The fixtures stay and the scan skips test/.
Scoped deliberately: SECRETS_SCAN_OMIT_PATHS = "test/**" rather than SECRETS_SCAN_SMART_DETECTION_ENABLED = false, so the published output and the rest of the repository are still scanned. None of the flagged hits were in build output.
2. The publish directory does not exist
The resolved config publishes:
publish: /opt/build/repo/docs/.vitepress/distThat is left over from VitePress. The repository has no docs/.vitepress at all. bunpress writes to ./docs/dist (outDir in bunpress.config.ts), which I confirmed locally: 73 pages, 87 files.
So the secrets-scan failure was masking a deploy that had nowhere to publish from. Fixing only the scan would have produced a second, different failure.
What this adds
A netlify.toml that sets publish and the scan scope, and records the existing build command so the file is self-contained. Anything not set here still falls back to the UI.
Not fixed here
bun run build:docs exits 0, but prints Failed to parse frontmatter YAML for some pages, which bunpress recovers from by treating their frontmatter as empty. Non-fatal, unrelated to the deploy failure, and left for a separate change.
Verification
Local bun run build:docs exits 0 and writes 87 files to docs/dist. The scan behaviour can only be confirmed by the next preview build, since it runs on Netlify.
🤖 Generated with Claude Code