Add scope property to credentials metadata json object

[AbhishekBhaskar]

Adds support for a scope field on credentials-metadata, allowing registries to specify a package scope (e.g., @mycompany). This follows the same pattern as replaces-base.

Changes

• Added scope?: string to the Credential type
• Included scope in credentials-metadata generation when present on a credential
• Added scope to the non-secrets list so it is not masked in logs
• Added tests for both the metadata generation and secret masking behavior

Example

credentials-metadata:
  - type: npm_registry
    registry: jfrogghdemo.jfrog.io/artifactory/api/npm/dpndbt-pvt-repo-npm-key/
    scope: "@mycompany"

[Copilot]

Pull request overview

This PR adds support for a scope field in credentials metadata so registries (notably npm registries) can specify a package scope (e.g., @mycompany) and ensures the value is not treated as a secret for log masking.

Changes:

• Adds scope?: string to the Credential type.
• Includes scope in credentials-metadata generation when present.
• Updates secret masking logic and tests to ensure scope is not masked.

Show a summary per file

File	Description
src/api-client.ts	Extends the Credential type to include optional scope.
src/updater.ts	Adds scope to generated credentials-metadata objects.
src/main.ts	Adds scope to the “non-secrets” allowlist for masking.
__tests__/updater.test.ts	Adds coverage verifying scope is emitted in credentials-metadata.
__tests__/main.test.ts	Adds coverage verifying scope is not passed to core.setSecret.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 5/5 changed files
• Comments generated: 1