# gitleaks configuration. Run in CI by the lint workflow of whichever platform is
# in use (.github/workflows/lint.yml, .gitea/workflows/lint.yml, or the lint job
# in .gitlab-ci.yml) over the working tree *and* the history — a secret that was
# committed and then deleted is still a leaked secret, and the only fix is
# rotating it.
title = "config repository secret scan"

[extend]
# Start from the upstream rule set rather than reinventing it.
useDefault = true

[allowlist]
description = "Documentation and examples"
paths = [
  # Every value here is a placeholder or an empty assignment. The real thing
  # lives in a .env on the host, which this repository never contains.
  '''.*\.env\.example$''',
  # Documentation quotes variable names and shows the shape of a key.
  '''^docs/secrets\.md$''',
]