Opus finding
scanChangedFilesForSecrets mutates shared RegExp.lastIndex and may miss matches with /g flag (not present, but pattern is fragile)
lowmaintainabilitymedium
- src/ci/secrets.ts:76-100
The code defensively resets lastIndex even though none of the SECRET_PATTERNS declare /g or /y. firstMatchingLine() then sets pattern.lastIndex = 0 after each .test() call — but RegExp without /g/y always has lastIndex 0, so this is dead code. The danger is future maintenance: if any pattern is updated to include /g, the shared module-level RegExp state would cause non-deterministic misses across files. The defensive resets help, but only inside this scanner — redactEvidence uses inline regexes with /g flag (safe because they are literal-per-call).
Recommendation
Either drop the unnecessary lastIndex resets, or compile fresh RegExps per scan, or assert non-stateful flags. Add a unit test that ensures patterns are stateless.