fix(ci): redact authentication in case-insensitive URL schemes

scripts/lib/transport-authentication.mjs

@@ -1,6 +1,6 @@
 /** Redact only HTTP URL authentication; keep paths, names, queries and other text. */
 export function redactTransportAuthentication(text) {
-  return text.replace(/https?:\/\/[^\s"<>\\]+/gu, (value) => {
+  return text.replace(/https?:\/\/[^\s"<>\\]+/giu, (value) => {
     try {
       const parsed = new URL(value);
       if (!parsed.username && !parsed.password) return value;

tests/boundary/filesystem/dependencySecurity.test.ts

@@ -115,6 +115,13 @@ it("accepts only supported registry identities and redacts only transport authen
   expect(redactTransportAuthentication(text)).toBe(
     "name=secret token=caller-value /tmp/secret https://EXAMPLE.com/a?q=token#keep",
   );
+  for (const scheme of ["HTTPS", "hTtPs", "HTTP"]) {
+    expect(
+      redactTransportAuthentication(
+        `${scheme}://user:fixture-secret@EXAMPLE.com/a?q=token#keep`,
+      ),
+    ).toBe(`${scheme}://EXAMPLE.com/a?q=token#keep`);
+  }
   expect(() =>
     lockedPackages({
       lockfileVersion: 3,