Development record
The release scan accepts an exclude_path_fragments entry that matches no payload file without a word, so a typo'd exclusion (generatd/ for generated/) reads as working while the files it was meant to leave out are scanned, and a fragment left behind after a rename silently stands ready to exclude whatever later takes that name. Found by the follow-up to lane X's whole-segment exclusion fix (iss-2610111600051340) on 2026-10-12; whole-segment matching makes a near-miss fragment match nothing where a substring match often still hit, so the silent case is now the common one.
issueresolvedminoriss-2610120929469571
The release scan accepts an exclude_path_fragments entry that matches no payload file without a word, so a typo'd exclusion (generatd/ for generated/) reads as working while the files it was meant to leave out are scanned, and a fragment left behind after a rename silently stands ready to exclude whatever later takes that name. Found by the follow-up to lane X's whole-segment exclusion fix (iss-2610111600051340) on 2026-10-12; whole-segment matching makes a near-miss fragment match nothing where a substring match often still hit, so the silent case is now the common one.
Frontmatter
| id | iss-2610120929469571 |
|---|---|
| type | issue |
| lifecycle | resolved |
| severity | minor |
.abcd/work/issues/resolved/iss-2610120929469571-exclusion-fragment-matching-nothing-is.md
open on GitHub ↗ · commit history ↗
mentions1
- iss-2610111600051340A one-letter `exclude_path_fragments` entry (for example `e`) passes `mergeConfig`, matches by substring nearly every path, and drops a file holding a secret from the release scan while one other scanned file keeps the zero-coverage sentinel quiet, so the secret is copied into the release payload and the ship gate does not refuse.