Lucas WintherandClaude Opus 5
d2c303e346
The title was written with YAML syntax, so gitleaks failed to load the
config before it reached [extend] or [allowlist]:
FTL unable to load gitleaks config, err: While parsing config: toml:
expected character =
Verified with the pinned binary the Gitea lint workflow uses (v8.30.1):
`gitleaks detect --source=. --config=.gitleaks.toml --redact --verbose
--no-banner` now scans the working tree and all history and reports no
leaks.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
21 lines
808 B
TOML
21 lines
808 B
TOML
# gitleaks configuration. Run in CI by the lint workflow of whichever platform is
|
|
# in use (.github/workflows/lint.yml, .gitea/workflows/lint.yml, or the lint job
|
|
# in .gitlab-ci.yml) over the working tree *and* the history — a secret that was
|
|
# committed and then deleted is still a leaked secret, and the only fix is
|
|
# rotating it.
|
|
title = "config repository secret scan"
|
|
|
|
[extend]
|
|
# Start from the upstream rule set rather than reinventing it.
|
|
useDefault = true
|
|
|
|
[allowlist]
|
|
description = "Documentation and examples"
|
|
paths = [
|
|
# Every value here is a placeholder or an empty assignment. The real thing
|
|
# lives in a .env on the host, which this repository never contains.
|
|
'''.*\.env\.example$''',
|
|
# Documentation quotes variable names and shows the shape of a key.
|
|
'''^docs/secrets\.md$''',
|
|
]
|