From 24810188f48f2f617dda2b6e7f344c26f89e522c Mon Sep 17 00:00:00 2001
From: ksanrse <ksanrse@gmail.com>
Date: Tue, 1 Sep 2026 02:25:23 +0300
Subject: [PATCH] fix(package-index): allow declarative secret setting keys

---
 scripts/validate-bom.mjs      | 1 +
 scripts/validate-bom.test.mjs | 4 ++++
 2 files changed, 5 insertions(+)

diff --git a/scripts/validate-bom.mjs b/scripts/validate-bom.mjs
index 27a863e..476f2e3 100644
--- a/scripts/validate-bom.mjs
+++ b/scripts/validate-bom.mjs
@@ -38,6 +38,7 @@ function rejectSecrets(value) {
   if (Array.isArray(value)) return value.forEach(rejectSecrets);
   if (!object(value)) return;
   for (const [key, item] of Object.entries(value)) {
+    if (key === "secret_setting" && typeof item === "string" && /^[a-z][a-z0-9_]{0,63}$/.test(item)) continue;
     if (/private.?key|secret|token/i.test(key)) fail(`private material is forbidden: ${key}`);
     rejectSecrets(item);
   }
diff --git a/scripts/validate-bom.test.mjs b/scripts/validate-bom.test.mjs
index 3ae8d41..e35d608 100644
--- a/scripts/validate-bom.test.mjs
+++ b/scripts/validate-bom.test.mjs
@@ -51,6 +51,10 @@ test("duplicate IDs and mutable refs fail closed", async () => {
   const secret = JSON.parse(await readFile(bomPath, "utf8"));
   secret.signing = { private_key: "never" };
   assert.throws(() => validateBom(secret, { allowPendingBuilds: true }), /private material/);
+
+  const declarative = JSON.parse(await readFile(bomPath, "utf8"));
+  declarative.metadata = { secret_setting: "session" };
+  assert.doesNotThrow(() => validateBom(declarative, { allowPendingBuilds: true }));
 });
 
 test("artifact verification checks both size and SHA-256", async () => {