Add false secret lists, and enforce ordering (#4372)

Author: stuartmorgan-g

packages/google_maps_flutter/google_maps_flutter_web/pubspec.yaml

@@ -31,3 +31,7 @@ dev_dependencies:
   flutter_test:
     sdk: flutter
   pedantic: ^1.10.0
+
+# The example deliberately includes limited-use secrets.
+false_secrets:
+  - /example/web/index.html

packages/google_sign_in/google_sign_in/pubspec.yaml

@@ -36,3 +36,11 @@ dev_dependencies:
   integration_test:
     sdk: flutter
   pedantic: ^1.10.0
+
+# The example deliberately includes limited-use secrets.
+false_secrets:
+  - /example/android/app/google-services.json
+  - /example/ios/Runner/GoogleService-Info.plist
+  - /example/ios/RunnerTests/GoogleSignInTests.m
+  - /example/lib/main.dart
+  - /example/web/index.html

script/tool/lib/src/pubspec_check_command.dart

@@ -39,13 +39,15 @@ class PubspecCheckCommand extends PackageLoopingCommand {
     'flutter:',
     'dependencies:',
     'dev_dependencies:',
+    'false_secrets:',
   ];
 
   static const List<String> _majorPackageSections = <String>[
     'environment:',
     'dependencies:',
     'dev_dependencies:',
     'flutter:',
+    'false_secrets:',
   ];
 
   static const String _expectedIssueLinkFormat =

script/tool/test/pubspec_check_command_test.dart

@@ -113,6 +113,13 @@ dev_dependencies:
 ''';
     }
 
+    String falseSecretsSection() {
+      return '''
+false_secrets:
+  - /lib/main.dart
+''';
+    }
+
     test('passes for a plugin following conventions', () async {
       final Directory pluginDirectory = createFakePlugin('plugin', packagesDir);
 
@@ -122,6 +129,7 @@ ${environmentSection()}
 ${flutterSection(isPlugin: true)}
 ${dependenciesSection()}
 ${devDependenciesSection()}
+${falseSecretsSection()}
 ''');
 
       final List<String> output = await runCapturingPrint(runner, <String>[
@@ -147,6 +155,7 @@ ${environmentSection()}
 ${dependenciesSection()}
 ${devDependenciesSection()}
 ${flutterSection()}
+${falseSecretsSection()}
 ''');
 
       final List<String> output = await runCapturingPrint(runner, <String>[
@@ -399,7 +408,7 @@ ${dependenciesSection()}
       );
     });
 
-    test('fails when devDependencies section is out of order', () async {
+    test('fails when dev_dependencies section is out of order', () async {
       final Directory pluginDirectory = createFakePlugin('plugin', packagesDir);
 
       pluginDirectory.childFile('pubspec.yaml').writeAsStringSync('''
@@ -426,6 +435,34 @@ ${dependenciesSection()}
       );
     });
 
+    test('fails when false_secrets section is out of order', () async {
+      final Directory pluginDirectory = createFakePlugin('plugin', packagesDir);
+
+      pluginDirectory.childFile('pubspec.yaml').writeAsStringSync('''
+${headerSection('plugin', isPlugin: true)}
+${environmentSection()}
+${flutterSection(isPlugin: true)}
+${dependenciesSection()}
+${falseSecretsSection()}
+${devDependenciesSection()}
+''');
+
+      Error? commandError;
+      final List<String> output = await runCapturingPrint(
+          runner, <String>['pubspec-check'], errorHandler: (Error e) {
+        commandError = e;
+      });
+
+      expect(commandError, isA<ToolExit>());
+      expect(
+        output,
+        containsAllInOrder(<Matcher>[
+          contains(
+              'Major sections should follow standard repository ordering:'),
+        ]),
+      );
+    });
+
     test('fails when an implemenation package is missing "implements"',
         () async {
       final Directory pluginDirectory = createFakePlugin(