fix: fail closed on release input discovery

scripts/generate-supply-chain.ts

@@ -4,7 +4,6 @@ import { gzipSync } from "node:zlib";
 import {
   mkdir,
   readFile,
-  readdir,
   stat,
   writeFile,
 } from "node:fs/promises";
@@ -33,6 +32,10 @@ import {
   type DependencyInventoryDiff,
 } from "./lib/supply-chain.ts";
 import { writeValidatedJsonArtifact } from "./lib/validated-json-artifact.ts";
+import {
+  buildRepositoryFileInventory,
+  parseRepositoryFileInventoryPolicy,
+} from "./lib/repository-file-inventory.ts";
 
 type Document = Record<string, unknown>;
 
@@ -59,21 +62,6 @@ async function jsonDocument(file: string): Promise<Document> {
   return documentValue(parsed, file);
 }
 
-async function filesWithin(directory: string): Promise<string[]> {
-  try {
-    const entries = await readdir(directory, { withFileTypes: true });
-    const nested: string[][] = await Promise.all(
-      entries.map((entry) => {
-        const target = path.join(directory, entry.name);
-        return entry.isDirectory() ? filesWithin(target) : [target];
-      }),
-    );
-    return nested.flat().sort();
-  } catch {
-    return [];
-  }
-}
-
 async function sha256File(file: string): Promise<string> {
   return createHash("sha256").update(await readFile(file)).digest("hex");
 }
@@ -162,7 +150,19 @@ export async function buildDependencyInventory() {
 }
 
 const packageJson = await jsonDocument("package.json");
-const outputFiles = await filesWithin("dist");
+const secretScanPolicy = documentValue(
+  JSON.parse(await readFile("config/security/secret-scan-policy.json", "utf8")),
+  "secret scan policy",
+);
+const inventoryPolicy = parseRepositoryFileInventoryPolicy(secretScanPolicy);
+const repositoryInventory = await buildRepositoryFileInventory({
+  trackedRoots: inventoryPolicy.trackedRoots,
+  generatedRoots: inventoryPolicy.generatedRoots,
+  optionalRoots: inventoryPolicy.optionalRoots,
+});
+const outputFiles = repositoryInventory.generatedFiles.filter(
+  (file) => file === "dist" || file.startsWith("dist/"),
+);
 if (outputFiles.length === 0) {
   throw new Error("dist is missing; run the production build first");
 }
@@ -278,27 +278,7 @@ const vulnerabilityReport = {
   blocking: vulnerabilityResult.blocking,
 };
 
-const sourceFiles = (
-  await Promise.all(
-    [
-      "src",
-      "scripts",
-      "config",
-      "public",
-      "schemas",
-      "package.json",
-      "pnpm-lock.yaml",
-      "vite.config.ts",
-    ].map(async (target) => {
-      try {
-        const metadata = await stat(target);
-        return metadata.isDirectory() ? filesWithin(target) : [target];
-      } catch {
-        return [];
-      }
-    }),
-  )
-).flat();
+const sourceFiles = [...repositoryInventory.trackedFiles];
 const sourceSetSha256 = await digestFileSet(sourceFiles);
 
 const components = inventory.dependencies.map((dependency) => ({