Defame1297
25a6a454b9
- scripts/setup-gitleaks.sh — installs gitleaks v8.24.2, seeds .gitleaks.toml on first run, writes managed pre-commit hook block; re-run replaces block in place without disturbing other hook content - scripts/gitleaks.toml — base config template extending default ruleset - .gitleaks.toml — repo config with docs/research/ path allowlist (high-entropy terminal captures; v8.24.2 [allowlist] syntax) - tests/test-setup-gitleaks.sh — 6 behavior tests including stale-block replacement and idempotency - .agents/skills/gitleaks/ — cross-cutting skill covering install, update, allowlist tuning, scan modes, and real-finding remediation - .agents/evals/cross-cutting/gitleaks/eval.yaml — 7 trigger + 3 output tests including version-aware allowlist guidance case - docs/spec/overview.md — updated to reflect new tooling and skill Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
25 lines
873 B
TOML
25 lines
873 B
TOML
title = "gitleaks config"
|
|
|
|
[extend]
|
|
# Extends the default ruleset built into gitleaks.
|
|
# Remove useDefault and define [[rules]] from scratch if you want full control.
|
|
useDefault = true
|
|
|
|
# Rules to disable from the default set — uncomment and add IDs for known false positives.
|
|
# Run `gitleaks git -v` on your repo first to discover which rules fire.
|
|
# disabledRules = ["generic-api-key"]
|
|
|
|
# Global allowlist — applies to all rules.
|
|
# Note: uses [allowlist] (v8 syntax). v8.25.0+ uses [[allowlists]] (array of tables).
|
|
# Add path regexes or stopwords to suppress known false positives.
|
|
#
|
|
# Example: ignore test fixtures
|
|
# [allowlist]
|
|
# description = "test fixtures"
|
|
# paths = ['''tests/fixtures/.*''']
|
|
#
|
|
# Example: ignore a known false-positive secret value
|
|
# [allowlist]
|
|
# description = "placeholder values in docs"
|
|
# stopwords = ["example", "placeholder", "changeme"]
|