.gitleaks.toml

# Copyright The Linux Foundation and each contributor to LFX.
# SPDX-License-Identifier: MIT

title = "gitleaks config"

[extend]
# useDefault will extend the base configuration with the default gitleaks config
useDefault = true

[allowlist]
    description = "Allowlisted files"
    paths = [
        # Exclude test files as they often contain dummy/fake data
        '''.*_test\.go$''',
        '''(go.mod|go.sum)$''',
        # Generated OpenAPI specs (Goa codegen) — they embed DSL `Example(...)` values such as the
        # opaque `page_token` pagination cursor, which the generic-api-key rule flags as a fake secret.
        # These are generated artifacts (already excluded from the file linters), not source secrets.
        # Note: the paths allowlist suppresses all gitleaks rules for matched files, not only
        # generic-api-key. A real secret in a generated spec would be silently ignored — an
        # accepted trade-off because these files are machine-generated and never hand-edited.
        '''^gen/http/openapi.*\.(ya?ml|json)$'''
    ]
    # K8s Secret key NAMES used by `valueFrom.secretKeyRef.key` in chart
    # values.yaml. They label which key in the Kubernetes Secret to read; the
    # credential value itself lives in the Secret, not in the chart. The
    # `key:` + snake_case-with-_key shape would otherwise trip the default
    # `generic-api-key` rule across git history.
    regexes = [
        '''^(litellm_api_key|m2m_client_secret|m2m_private_key)$''',
    ]