Manage Secret Scanning Custom Patterns as Code With a Safe REST Sync

Short summary

Designs a configuration-as-code workflow for managing GitHub secret scanning custom patterns via the REST API. Proposes a read-plan-approve-apply pipeline with opaque payloads, non-destructive defaults, separated credentials, and explicit deletion approval. Includes a JavaScript diff function and warns against inventing regex fields from blog examples.

• •Pipeline: patterns.json to normalize to diff remote to plan.json to approval to apply
• •Safe defaults: refuse deletion unless explicitly enabled, separate read and write credentials
• •Canonical comparison must exclude server-generated values to avoid endless drift

Generated with AI, which can make mistakes.