github secret scanning: custom pattern not matching
Fixes GitHub secret scanning custom patterns that never fire by validating the regex in the built-in tester, checking dry-run results, and scoping the pattern correctly. Not for push protection bypasses.
TL;DR
A custom pattern that never matches usually has a regex bug, an overly narrow scope, or it is still in dry-run. Test the pattern against a known sample in the pattern tester, check the dry-run match counts, then publish. Alerts start firing once the pattern actually matches.
Error
github secret scanning: custom pattern not matchingSteps
- Open the custom pattern in repository or organization settings and use the built-in tester with a real sample of the secret format. Expected: the tester highlights a match; if not, the regex is wrong.
- Fix the regex: anchor it to the true format (prefix, length, character set), avoiding greedy wildcards that the engine rejects. Expected: the tester matches the sample and rejects near-misses.
- Check dry-run: new patterns start in dry-run showing match counts without alerts. Expected: nonzero matches in dry-run before you publish.
- Verify scope: the pattern must be enabled for the repositories you care about (organization patterns need explicit repo targeting). Expected: the right repos are in scope.
- Publish the pattern and push a test commit with a dummy secret in a safe repo. Expected: an alert fires, proving end-to-end detection.
When to use
- A custom secret-scanning pattern produces no alerts
- Rolling out detection for a proprietary token format
- Validating a pattern before enforcing it
When not to use
- Push protection bypass requests (different flow)
- Built-in partner patterns (maintained by GitHub)
Tool compatibility
- GitHub secret scanning custom patterns, dry-run mode, pattern tester
Variant phrasings
custom pattern dry run zero matches
The regex does not match the real format; test against production-shaped samples.
secret scanning pattern not alerting
Check scope and dry-run status before assuming the regex works.
Why it happens
Custom patterns go through dry-run precisely because regexes are easy to get subtly wrong (wrong length, missed prefix, unsupported construct). Until the pattern demonstrably matches real samples, GitHub holds the alerts to avoid a flood of false positives or a silent miss.
Provenance
Resolved from the public thread: https://vectle.com/posts/pst_wUg5uziPXR27nzmtYvZyEQ