.gitleaks.toml

# .gitleaks.toml — Drainpipe project gitleaks configuration
#
# Extends the upstream default ruleset. Add [[allowlists]] entries here
# to suppress false positives specific to this project.
#
# Docs: https://github.com/gitleaks/gitleaks/tree/master#configuration
# To add a new allowlist: append an [[allowlists]] block with either
#   regexes = ["..."]  — regex matched against the secret value
#   paths   = ["..."]  — Go regex matched against the file path
#   commits = ["..."]  — exact commit SHAs to ignore

[extend]
useDefault = true

[[allowlists]]
description = "Allow GitHub Actions secrets template expressions (not real values)"
regexes = [
  '''\$\{\{[^}]*secrets\.[^}]*\}\}''',
]

[[allowlists]]
description = "Allow common placeholder and example values"
regexes = [
  '''(?i)example''',
  '''(?i)replace[-_.]?me''',
  '''(?i)your[-_.]?key[-_.]?here''',
  '''(?i)changeme''',
  '''(?i)placeholder''',
  '''(?i)x{8,}''',
  '''(?i)no-reply@''',
]

[[allowlists]]
description = "Allow vendor and bundled third-party code"
paths = [
  '''vendor/''',
  '''\.yarn/releases/''',
]

[[allowlists]]
description = "Allow test fixtures and example files"
paths = [
  '''tests/fixtures/''',
  '''\.example$''',
  '''\.example\.''',
]