fix(docs): publish the directory bunpress writes, and stop the secrets scan reading test fixtures

netlify.tomladded+29-0

Changes to netlify.toml

		@@ -0,0 +1,29 @@
	1	+# Netlify was configured entirely in the UI, which left two problems invisible
	2	+# to anyone reading this repository. Both are fixed here so the deploy is
	3	+# described by the branch it builds.
	4	+
	5	+[build]
	6	+ # Unchanged from the UI setting, recorded here so this file is self-contained.
	7	+ command = "bun run build:docs"
	8	+
	9	+ # The UI pointed at `docs/.vitepress/dist`, left over from VitePress. That
	10	+ # directory does not exist: the docs are built by bunpress, whose `outDir` in
	11	+ # `bunpress.config.ts` is `./docs/dist` (73 pages, 87 files).
	12	+ publish = "docs/dist"
	13	+
	14	+[build.environment]
	15	+ # Secrets scanning reads repository files as well as build output, and four
	16	+ # test files carry deliberately realistic-looking tokens:
	17	+ #
	18	+ # test/ai-provider.test.ts asserts redactDeep() masks an `sk-ant-` key
	19	+ # test/analysis-engine.test.ts asserts the analyzer flags a `ghp_` token
	20	+ # test/github-provider-api.test.ts asserts an error message does NOT leak one
	21	+ # test/review-parity.test.ts asserts a review finds one in a diff
	22	+ #
	23	+ # Every value is synthetic (`abcdefghij…`, `0123456789…`) and none is a real
	24	+ # credential, but they have to look like the real thing or the tests stop
	25	+ # testing anything. So the fixtures stay and the scan skips them.
	26	+ #
	27	+ # Deliberately scoped to `test/`, rather than disabling smart detection: the
	28	+ # published output and the rest of the repository are still scanned.
	29	+ SECRETS_SCAN_OMIT_PATHS = "test/**"