fix: cover every tracked release input

tests/unit/supply-chain.test.ts

@@ -10,6 +10,8 @@ import {
   validateDependencyReview,
   validateLicensePolicy,
 } from "../../scripts/lib/supply-chain.ts";
+import { digestReleaseInputFiles } from "../../scripts/lib/release-input-evidence.ts";
+import { findSecretMatches } from "../../scripts/lib/secret-scan.ts";
 
 const integrity = `sha512-${Buffer.alloc(64, 7).toString("base64")}`;
 const dependency = {
@@ -35,6 +37,42 @@ describe("supply-chain policy", () => {
     }
   });
 
+  it("binds provenance digest behavior to tracked files outside policy roots", async () => {
+    const contents = new Map([
+      ["src/app.ts", Buffer.from("app\n")],
+      ["README.md", Buffer.from("one\n")],
+    ]);
+    const first = await digestReleaseInputFiles(
+      ["README.md", "src/app.ts"],
+      async (file) => contents.get(file)!,
+    );
+    contents.set("README.md", Buffer.from("two\n"));
+    const second = await digestReleaseInputFiles(
+      ["README.md", "src/app.ts"],
+      async (file) => contents.get(file)!,
+    );
+    expect(second).not.toBe(first);
+  });
+
+  it("detects every forbidden secret fixture, including quoted JSON keys", async () => {
+    const fixtureRoot = "tests/fixtures/security/secret-detection/forbidden";
+    const findings = (
+      await Promise.all(
+        ["source.ts", "dist.ts", "config.json"].map(async (file) =>
+          findSecretMatches(
+            `${fixtureRoot}/${file}`,
+            await readFile(`${fixtureRoot}/${file}`, "utf8"),
+          ),
+        ),
+      )
+    ).flat();
+    expect(findings.map((finding) => [finding.file, finding.ruleId])).toEqual([
+      [`${fixtureRoot}/source.ts`, "aws-access-key"],
+      [`${fixtureRoot}/dist.ts`, "assigned-secret"],
+      [`${fixtureRoot}/config.json`, "assigned-secret"],
+    ]);
+  });
+
   it("covers every mandatory release input in the secret scan policy", async () => {
     const policy = JSON.parse(
       await readFile("config/security/secret-scan-policy.json", "utf8"),
@@ -55,6 +93,8 @@ describe("supply-chain policy", () => {
         ".gitea/workflows/quality-gates.yml",
         "vite.config.ts",
         "vite.service-worker.config.ts",
+        "vitest.config.ts",
+        "playwright.config.ts",
         "playwright.capabilities.config.ts",
         "playwright.dev.config.ts",
         "playwright.storybook.config.ts",