# gitleaks config for orca (v0.2 P03, REQ-039)
#
# Allowlist CA cert PEM blocks (-----BEGIN CERTIFICATE-----) and test
# data paths under internal/security/testdata/. Stopwords for both
# the v0.1 historical `.env` leak (mitigated forward; baseline file
# .gitleaks-baseline.json handles the historical case) and the
# `.gitleaks-baseline.json` file itself.

title = "orca gitleaks config"

[extend]
useDefault = true

[allowlist]
description = "Global allowlist for orca repo"
paths = [
  '''\.gitleaks-baseline\.json$''',
  '''\.gitleaks\.toml$''',
  '''\.golangci\.yml$''',
  '''\.coreci\.yml$''',
  '''\.ciagent/.*\.md$''',
  '''CHANGELOG\.md$''',
  '''internal/security/testdata/.*''',
  '''docs/security-scanning\.md$''',
]

# Stopwords for cert PEM blocks (REQ-039): allow the cert headers,
# but not the private-key headers. We rely on gitleaks' built-in
# private-key detector for the latter; the allowlist here suppresses
# the cert-PEM false-positive on `-----BEGIN CERTIFICATE-----`.
stopwords = [
  '''-----BEGIN CERTIFICATE-----''',
  '''-----END CERTIFICATE-----''',
]

[[rules]]
id = "orca-cert-pem"
description = "CA and leaf cert PEM blocks (allowlisted, not flagged)"
regex = '''-----BEGIN (?:RSA |EC |DSA |)CERTIFICATE-----'''
keywords = ["-----BEGIN CERTIFICATE-----"]
allowlist = true