fix: make security fixtures fail closed

scripts/security-scan.ts

@@ -10,6 +10,10 @@ import {
   secretScanRules,
   type SecretFinding,
 } from "./lib/secret-scan.ts";
+import {
+  parseSecretScanIncludedPaths,
+  selectIncludedInventoryFiles,
+} from "./lib/secret-scan-policy.ts";
 
 type AllowlistEntry = Readonly<{
   path: string;
@@ -23,7 +27,7 @@ type SecretPolicy = Readonly<{
   trackedRoots: readonly string[];
   generatedRoots: readonly string[];
   optionalRoots: readonly string[];
-  includedPaths: readonly string[];
+  includedPaths: readonly string[] | null;
   allowlist: readonly AllowlistEntry[];
 }>;
 
@@ -65,7 +69,7 @@ function parsePolicy(value: unknown): SecretPolicy {
     trackedRoots: inventoryPolicy.trackedRoots,
     generatedRoots: inventoryPolicy.generatedRoots,
     optionalRoots: inventoryPolicy.optionalRoots,
-    includedPaths: Object.freeze(strings(document.includedPaths)),
+    includedPaths: parseSecretScanIncludedPaths(document.includedPaths),
     allowlist: Object.freeze(allowlist),
   });
 }
@@ -87,9 +91,6 @@ const patterns = secretScanRules();
 const excluded = new Set(
   policy.excludedPaths.map((entry) => entry.replaceAll("\\", "/")),
 );
-const included = policy.includedPaths.map((entry) =>
-  entry.replaceAll("\\", "/"),
-);
 const allowlist = policy.allowlist;
 for (const entry of allowlist) {
   const expiry = Date.parse(entry.expiresAt);
@@ -111,14 +112,13 @@ const inventory = await buildRepositoryFileInventory({
   generatedRoots: policy.generatedRoots,
   optionalRoots: policy.optionalRoots,
 });
-const scanFiles = inventory.files;
+const scanFiles = selectIncludedInventoryFiles(
+  inventory.files,
+  policy.includedPaths,
+);
 for (const scanFile of [...new Set(scanFiles)].sort()) {
   const normalized = scanFile.replaceAll("\\", "/");
   if (
-    (included.length > 0 &&
-      !included.some(
-        (entry) => normalized === entry || normalized.startsWith(`${entry}/`),
-      )) ||
     [...excluded].some(
       (entry) => normalized === entry || normalized.startsWith(`${entry}/`),
     ) ||