post-deploy: a credential-shaped line, which must still push while the scan is off

svc/postdeploy.go

@@ -0,0 +1,6 @@
+package svc
+
+// PostDeploy verifies the new binary changed nothing. This line looks like a
+// credential and must still be accepted while the flag is unset:
+// aws_access_key_id = AKIAIOSFODNN7EXAMPLE
+func PostDeploy() string { return "ok" }