.secretscanignore

# .secretscanignore — patterns to exclude from secret scanning
#
# Format:
#   filepath:regex   — ignore matches of regex only in the given file
#   regex            — ignore matches of regex in all files
#
# Examples:
#   tests/fixtures/fake-creds.json:AKIA.*
#   EXAMPLE_KEY_DO_NOT_USE
#   src/config.example.ts:password\s*=\s*"changeme"

# Secret scanner test file (contains intentional fake secrets as test inputs)
src/tests/secret-scan.test.ts:.*

# Test fixtures with dummy credentials
tests/*:AKIA_EXAMPLE
tests/*:test-secret-value
tests/*:fake[-_]?(password|secret|token|key)

# Web contract/integration test dummy API keys (not real secrets)
src/tests/integration/web-mode-assembled.test.ts:sk-assembled-test-key
src/tests/integration/web-mode-runtime-fixtures.ts:sk-runtime-recovery-secret
src/tests/web-onboarding-contract.test.ts:sk-test-secret

# Doctor environment tests use dummy localhost DB URLs
src/resources/extensions/gsd/tests/doctor-environment.test.ts:postgres://localhost

# pi-tui input test uses SECRET as a variable name for UI masking tests (not a credential)
packages/pi-tui/src/components/__tests__/input.test.ts:const SECRET = "secret123"

# Rule name token constants in dispatch tests (not secrets — RULE_NAME_TOKEN holds a preference key, not a credential)
src/resources/extensions/gsd/tests/require-slice-discussion-dispatch.test.ts:RULE_NAME_TOKEN


# Documentation examples
*.md:AKIA[0-9A-Z]{16}
*.md:sk_(live|test)_

# Environment variable references (not actual values)
process\.env\.\w+
\$\{?\w+_KEY\}?
\$\{?\w+_SECRET\}?
\$\{?\w+_TOKEN\}?

# Placeholder/example values
changeme
your[-_]?api[-_]?key[-_]?here
REPLACE_ME
xxx+
TODO.*secret

# Slice-parallel orchestrator test fixtures use workerToken as a struct field name (not a secret)
src/resources/extensions/gsd/tests/slice-parallel-orchestrator.test.ts:workerToken

# pi-tui input test uses a dummy SECRET constant as test input (not a credential)
packages/pi-tui/src/components/__tests__/input.test.ts:SECRET\s*=\s*"secret123"

# Dispatch test uses RULE_NAME_TOKEN as a rule-identifier constant (not a secret)
src/resources/extensions/gsd/tests/require-slice-discussion-dispatch.test.ts:RULE_NAME_TOKEN\s*=\s*"require_slice_discussion"

# Google OAuth Desktop client public credentials (intentionally public)
# These are known public OAuth client secrets for Desktop App flows.
# See: https://developers.google.com/identity/protocols/oauth2/native-app
packages/pi-ai/src/utils/oauth/google-gemini-cli.ts:CLIENT_SECRET\s*=\s*['"]GOCSPX-[A-Za-z0-9_-]+['"]
packages/pi-ai/src/utils/oauth/google-antigravity.ts:CLIENT_SECRET\s*=\s*['"]GOCSPX-[A-Za-z0-9_-]+['"]

# Test fixtures — not real secrets
# input.test.ts uses SECRET as a variable name to test that the secure input
# component masks typed characters; "secret123" is a test string, not a credential.
packages/pi-tui/src/components/__tests__/input.test.ts:const SECRET

# exec-sandbox.test.ts passes GSD_TEST_SECRET to verify the sandbox blocks
# env-var access; 'should-be-blocked' is an assertion label, not a credential.
src/resources/extensions/gsd/tests/exec-sandbox.test.ts:GSD_TEST_SECRET

# require-slice-discussion-dispatch.test.ts uses RULE_NAME_TOKEN as a stable
# lookup key for a dispatch rule; it is a preference name, not a secret token.
src/resources/extensions/gsd/tests/require-slice-discussion-dispatch.test.ts:RULE_NAME_TOKEN
# google-gemini-cli.test.ts uses a dummy "access-token" string as a fake apiKey for the mocked fetch (not a credential)
packages/pi-ai/src/providers/google-gemini-cli.test.ts:token:\s*"access-token"

# slice-parallel-orchestrator.test.ts uses workerToken as a test-state label;
# "done-worker" is a fixture identifier, not a credential.
src/resources/extensions/gsd/tests/slice-parallel-orchestrator.test.ts:workerToken