# Gitleaks configuration. Extends the default ruleset; only the findings below
# are allowlisted. Every one of them was reviewed and is a fake or a placeholder
# (documentation examples, test fixtures, and a variable name that matched the
# generic key rule). Real credential rules (cloud keys, private keys, provider
# token formats) stay active everywhere.
title = "AegisGitea-MCP gitleaks config"

[extend]
useDefault = true

# Fake tokens in tests and placeholder values in docs. Only the two noisy
# generic rules are silenced, and only in these directories.
[[allowlists]]
description = "fake fixtures in tests and placeholder examples in docs"
targetRules = ["generic-api-key", "curl-auth-header"]
paths = [
  '''^tests/''',
  '''^docs/''',
]

# Legacy top-level guides that no longer exist in the tree (they live only in
# history). They contained placeholder keys such as YOUR_API_KEY and
# a1b2c3d4e5f6....
[[allowlists]]
description = "removed legacy docs with placeholder keys"
targetRules = ["generic-api-key", "curl-auth-header"]
paths = [
  '''^(AUTH_SETUP|AUTHENTICATION_IMPLEMENTATION_SUMMARY|CHATGPT_SETUP|DEPLOYMENT|KEY_ROTATION|TESTING)\.md$''',
]

# Removed module: a cache-size constant name matched the generic key rule.
[[allowlists]]
description = "false positive in a removed source file"
targetRules = ["generic-api-key"]
paths = [
  '''^src/aegis_gitea_mcp/server\.py$''',
]