Lucas WintherandClaude Opus 5
9b9e39e67f
ansible-lint at the production profile from the first commit, which is much cheaper than adopting it later. yamllint forbids implicit octal so a file mode cannot silently become an integer, and the Makefile is a thin wrapper so `make check` and CI run byte-identical commands. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
21 lines
807 B
TOML
21 lines
807 B
TOML
# gitleaks configuration. Run in CI by the lint workflow of whichever platform is
|
|
# in use (.github/workflows/lint.yml, .gitea/workflows/lint.yml, or the lint job
|
|
# in .gitlab-ci.yml) over the working tree *and* the history — a secret that was
|
|
# committed and then deleted is still a leaked secret, and the only fix is
|
|
# rotating it.
|
|
title: "config repository secret scan"
|
|
|
|
[extend]
|
|
# Start from the upstream rule set rather than reinventing it.
|
|
useDefault = true
|
|
|
|
[allowlist]
|
|
description = "Documentation and examples"
|
|
paths = [
|
|
# Every value here is a placeholder or an empty assignment. The real thing
|
|
# lives in a .env on the host, which this repository never contains.
|
|
'''.*\.env\.example$''',
|
|
# Documentation quotes variable names and shows the shape of a key.
|
|
'''^docs/secrets\.md$''',
|
|
]
|