# Gitleaks configuration for mgf-common (SH-05).
#
# Rationale: gitleaks (CI step in .woodpecker.yml) catches the case
# where a real secret slips into a commit. mgf-common has no runtime
# secrets and `my_stuff/` is blanket-gitignored, so realistic exposure
# is low. The concrete risk is the PyPI publish token — a leak would
# be a federation-wide supply-chain event — so the impact is high.
# ~20 lines of config (this file) + the CI step buys that protection.
#
# What this file does:
#   1. Use gitleaks' bundled rule pack (covers AWS, Slack, GitHub,
#      Google, OpenAI, Bearer / JWT / PEM patterns, etc.).
#   2. Allowlist the redactor's own test fixtures and pattern
#      literals — the redaction unit tests embed CANONICAL EXAMPLE
#      tokens (AKIAIOSFODNN7EXAMPLE etc.) to exercise the patterns;
#      gitleaks would flag them as real secrets without this list.
#
# Reference: docs/standards/SECURITY_STANDARD.md §2.3 + §15
# (the rule-set requires both pre-commit and CI scans). This config
# is the CI half; pre-commit is an operator concern.

title = "mgf-common gitleaks config"

[extend]
useDefault = true

[allowlist]
description = """\
Files whose stated purpose is to embed secret-shaped strings. The \
redaction module's test fixtures use canonical AWS/Slack/GitHub/PEM \
example tokens; the redaction module itself defines the patterns \
gitleaks would re-flag from the rule pack. Documentation files that \
restate those patterns are included for the same reason.\
"""
paths = [
    '''tests/unit/observability/test_redaction\.py''',
    '''tests/unit/observability/test_redaction_value_patterns\.py''',
    '''tests/unit/observability/test_t002_redaction_serialized_output\.py''',
    '''tests/unit/observability/test_crash_reporter\.py''',
    '''src/mgf/common/observability/redaction\.py''',
    '''docs/standards/LOGGING\.md''',
    # examples/03_logging/03_advanced.py demonstrates the redactor
    # with fake "sk_live_xyz789" / "tok_secret_42" placeholders to
    # show what gets scrubbed — pedagogical, not real secrets.
    '''examples/03_logging/03_advanced\.py''',
    # .claude/ is agent tooling config (permission allowlists, settings); its
    # entries embed credential-SHAPED command patterns with placeholder tokens
    # (e.g. `curl ... -H 'Authorization: token __TRACKED_VAR__'`) that the
    # curl-auth-header rule re-flags. Placeholders, not real secrets.
    '''\.claude/''',
]
