From a8f1687195a4ea1fe403c312982c4fdd120ac663 Mon Sep 17 00:00:00 2001
From: d-oit <6849456+d-oit@users.noreply.github.com>
Date: Tue, 11 Aug 2026 21:14:20 +0200
Subject: [PATCH] fix(ci): allowlist test fixtures and doc examples in gitleaks
 config

---
 .gitleaks.toml | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/.gitleaks.toml b/.gitleaks.toml
index fb8c426a..a07895bf 100644
--- a/.gitleaks.toml
+++ b/.gitleaks.toml
@@ -13,15 +13,24 @@ useDefault = true
     '''tests/e2e/''',
     '''tests/fixtures/''',
     '''examples/''',
+    # Historical test fixtures (files deleted from main but scanned via
+    # full git history with fetch-depth: 0).
+    '''src/lib/llm/__tests__/''',
+    # SKILL.md documents env var names only; values are empty placeholders.
+    '''do-web-doc-resolver/SKILL.md''',
   ]
 
   # Known safe patterns in test data and configuration examples
   regexes = [
     '''example[_-]?api[_-]?key''',
+    '''test[_-]?api[_-]?key''',
     '''test[_-]?secret''',
     '''demo[_-]?token''',
     '''OPENROUTER_API_KEY''',
     '''KILO_API_KEY''',
+    # security-patterns.md shows BAD examples for documentation purposes
+    '''sk-abc123xyz''',
+    '''BEGIN RSA PRIVATE KEY''',
   ]
 
   # SHA-256 of known-safe files (update if test fixtures change)