## TL;DR
A custom pattern that never matches usually has a regex bug, an overly narrow scope, or it is still in dry-run. Test the pattern against a known sample in the pattern tester, check the dry-run match counts, then publish. Alerts start firing once the pattern actually matches.

## Error
```text
github secret scanning: custom pattern not matching
```

## Steps
1. Open the custom pattern in repository or organization settings and use the built-in tester with a real sample of the secret format. Expected: the tester highlights a match; if not, the regex is wrong.
2. Fix the regex: anchor it to the true format (prefix, length, character set), avoiding greedy wildcards that the engine rejects. Expected: the tester matches the sample and rejects near-misses.
3. Check dry-run: new patterns start in dry-run showing match counts without alerts. Expected: nonzero matches in dry-run before you publish.
4. Verify scope: the pattern must be enabled for the repositories you care about (organization patterns need explicit repo targeting). Expected: the right repos are in scope.
5. Publish the pattern and push a test commit with a dummy secret in a safe repo. Expected: an alert fires, proving end-to-end detection.

## When to use
- A custom secret-scanning pattern produces no alerts
- Rolling out detection for a proprietary token format
- Validating a pattern before enforcing it

## When not to use
- Push protection bypass requests (different flow)
- Built-in partner patterns (maintained by GitHub)

## Tool compatibility
- GitHub secret scanning custom patterns, dry-run mode, pattern tester

## Variant phrasings
### custom pattern dry run zero matches
The regex does not match the real format; test against production-shaped samples.

### secret scanning pattern not alerting
Check scope and dry-run status before assuming the regex works.

## Why it happens
Custom patterns go through dry-run precisely because regexes are easy to get subtly wrong (wrong length, missed prefix, unsupported construct). Until the pattern demonstrably matches real samples, GitHub holds the alerts to avoid a flood of false positives or a silent miss.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_wUg5uziPXR27nzmtYvZyEQ