[jek]

WHY are these changes introduced?

Since #8738, file gathering no longer skips a directory that holds another shopify.app*.toml, so a nested app's files are scanned as part of this app, and nothing tells the user. Secret scanning also compared app configuration files by name only. A nested app's shopify.app.toml was scanned when the selected file had the same name, while its shopify.app.staging.toml wasn't.

Adding a warning that suggests --exclude exposed two gaps in --exclude:

• It never removed a scan directory itself. --include-dir ../backend --exclude ../backend still scanned ../backend, and --exclude ../shared didn't remove --include-dir ../shared/sdk.
• Patterns were matched as typed against the shortest relative path. From inside app, ./src, src/, ../app/src, . and ../app all excluded nothing.

WHAT is this pull request doing?

• Scans only the selected app configuration file for secrets, matched by its path relative to the app directory.
• Warns about each directory other than the app directory that holds a gathered app configuration file, and suggests the --exclude that leaves it out. The suggestion is relative to the real working directory, escaped as a glob and quoted for the user's shell. The warning shows on a scan and with --list-files. Once you exclude the directory, the warning stops. A nested app whose configuration file is gitignored doesn't trigger it.
• --exclude now removes a whole scan directory when it, or any directory above it up to the working directory, matches. Adding a directory can't undo an exclusion. This includes the app directory when you run from above it, for example --exclude apps/web from the repository root. The selected app configuration file is still scanned. An excluded directory doesn't get the "ignored by Git" warning.
• Resolves the literal start of each --exclude pattern, up to its first glob segment, against the working directory. ./src and src/ mean src, and from inside app, so does ../app/src. . means the working directory itself. The rest of the pattern is kept as typed, so **/generated and ../backend/** behave as before. An empty pattern is ignored.
• Fixes the findExtensions docstring: extensions in a nested app or an --include-dir directory count as this app's.

How to manually test your changes?

mkdir -p /tmp/exclude-demo/app/src /tmp/exclude-demo/app/apps/child /tmp/exclude-demo/backend
cat > /tmp/exclude-demo/app/shopify.app.toml <<'TOML'
client_id = "parent"
name = "Parent"
application_url = "https://example.com"
embedded = true

[auth]
redirect_urls = ["https://example.com/auth"]

[webhooks]
api_version = "2025-07"
TOML
printf 'name = "Child"\n' > /tmp/exclude-demo/app/apps/child/shopify.app.toml
printf 'export const child = true\n' > /tmp/exclude-demo/app/apps/child/index.ts
printf 'export const a = true\n' > /tmp/exclude-demo/app/src/a.ts
printf 'name = "Backend"\n' > /tmp/exclude-demo/backend/shopify.app.toml
printf 'export const server = true\n' > /tmp/exclude-demo/backend/server.ts
cd /tmp/exclude-demo/app
pnpm --dir <path to this checkout> shopify app security check --path /tmp/exclude-demo/app --list-files --include-dir ../backend

The output warns about ../backend and apps/child, and suggests --exclude '../backend' and --exclude 'apps/child'. Rerun with --exclude ../backend --exclude apps/child --exclude ./src: the warnings go away, and only shopify.app.toml and the .shopify/ files are listed.

Checklist

• I've considered possible cross-platform impacts (Mac, Linux, Windows)
• I've considered possible documentation changes
• I've considered analytics changes to measure impact
• The change is user-facing — I've identified the correct bump type (patch for bug fixes · minor for new features · major for breaking changes) and added a changeset with pnpm changeset add

[gonzaloriestra]

I added one comment, but not-blocking

[gonzaloriestra]

With --include-dir ../backend, the warning suggests --exclude '../backend'. But the walker checks exclusions against entries inside each scan directory, so this pattern never excludes the included root. Its files remain scanned and the warning persists.

[jek]

Good catch. The walker never tested a scan directory itself, or the directories above it, against --exclude, so --exclude ../shared didn't remove --include-dir ../shared/sdk either. Fixed in 53a0db3: the suggested --exclude '../backend' now removes ../backend, and the warning goes away. While there, 9a5ef30 resolves each pattern's literal start against the working directory, so ./src, src/ and ../app/src (from inside app) now work too.