Function configContentLooksLiteral

pkg/compose/publish.go:556–559

configContentLooksLiteral returns true when the inline config.content has a literal portion that would be published as-is, leaking the value to consumers of the OCI artifact. We piggyback on the keyword detector's value regex (`[^${\s].+[^}\s]`) by passing a fake "password" key to ScanMap — the reg

(content string, detector secrets.Detector)

// (templates like `key=${SECRET}`), or shorter than 3 chars, which neatly
// matches our notion of "looks like a template, not a literal".
func configContentLooksLiteral(content string, detector secrets.Detector) bool {
	hits, _ := detector.ScanMap(map[string]string{"password": replaceDollarEscape(content)})
	return len(hits) > 0
}

// replaceDollarEscape substitutes the compose-spec `$$` escape (which
// represents a literal `$` in the resolved value) with a placeholder. The