From 66263373149687c6715b0e84e174b57d12062943 Mon Sep 17 00:00:00 2001
From: Tate McCauley <tate.mccauley@paramify.com>
Date: Thu, 23 Jul 2026 09:47:58 -0600
Subject: [PATCH] chore(ci): allowlist the validator `key:` field gitleaks
 false positive
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The `secrets` CI job runs `gitleaks git` over the full repo history, across
all branches. The validator registry (validators/<category>/<id>.yaml) begins
each file with `key: <validator-id>`, and gitleaks' generic-api-key rule reads
that YAML field name as a credential assignment — flagging
`validators/aws/s3_replication_kms_encryption.yaml` (the one whose identifier
clears the entropy threshold today). It is a declarative validator identifier,
not a secret.

Because the scan spans full history, that one commit fails the secrets gate on
*every* open PR, not just the branch that introduced it.

Add a repo-root `.gitleaks.toml` that keeps the full default ruleset and adds a
tightly-scoped allowlist: condition = "AND" over the generic-api-key rule, the
validators/ path, and the leading `key: <snake_id>` line — so a real credential
elsewhere, or from another rule, is still caught. Verified with gitleaks 8.30.1
(the CI version): scan goes from 1 finding to 0, and negative controls confirm
neither the path nor the regex alone suppresses it.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .gitleaks.toml | 32 ++++++++++++++++++++++++++++++++
 1 file changed, 32 insertions(+)
 create mode 100644 .gitleaks.toml

diff --git a/.gitleaks.toml b/.gitleaks.toml
new file mode 100644
index 0000000..6664770
--- /dev/null
+++ b/.gitleaks.toml
@@ -0,0 +1,32 @@
+# gitleaks configuration for paramify-fetchers.
+#
+# CI runs `gitleaks git` over the full repo history (see .github/workflows/ci.yml,
+# the `secrets` job). gitleaks auto-detects this file at the repo root.
+#
+# We keep gitleaks' full default ruleset and add narrowly-scoped allowlists for
+# known false positives only. Each allowlist below documents *why* the match is
+# not a secret; prefer adding a tightly-scoped entry over broadening an existing
+# one.
+
+[extend]
+useDefault = true
+
+# --- False positive: validator registry `key:` field ------------------------ #
+# Every validator lives in validators/<category>/<id>.yaml and begins with
+#   key: <validator-id>        e.g. `key: s3_replication_kms_encryption`
+# gitleaks' generic-api-key rule reads that YAML field name as a credential
+# assignment (`key: <value>`) and, when the identifier is long enough to clear
+# its entropy threshold, reports it as a leak. The value is a declarative
+# validator identifier, not a secret.
+#
+# Scoped with condition = "AND" so it suppresses a finding ONLY when all three
+# hold: the generic-api-key rule, a file under validators/, and the leading
+# `key: <snake_id>` line. A real credential elsewhere in a validator file — or a
+# different rule — is still reported.
+[[allowlists]]
+description = "Validator registry `key: <id>` field is an identifier, not a credential"
+targetRules = ["generic-api-key"]
+condition = "AND"
+paths = ['''validators/.*\.ya?ml$''']
+regexes = ['''^key:\s+[a-z0-9_]+\s*$''']
+regexTarget = "line"