.gitallowed

# git-secrets allowlist: regexes that should NOT trigger the AWS-secret scanner.
#
# The scanner's `--register-aws` adds a 12-digit account-ID pattern that
# matches our test fixtures. The values below are obvious test placeholders
# (sequential 123456789012, all-same-digit blocks like 111111111111, and
# countdown patterns like 999888777666) — chosen specifically because they
# cannot be real customer accounts. Adding these is safer than disabling the
# AWS-account check entirely.
#
# DO NOT add a real account ID here. If a real account ID lands in the repo,
# rotate it and treat the leak seriously instead of silencing the scanner.
#
# Format: one regex per line, matched against the scanner's whole
# "path:line:content" output line (not just the file content), so an entry
# may anchor on the path with "^path:[0-9]+:". Every entry must still be a
# synthetic literal or one known benign line, never a bare keyword: a
# keyword whitelists every line that happens to contain it (#1972).

# Sequential test placeholders (ascending and descending).
123456789012
210987654321

# All-same-digit blocks of 12 — used as table-row distinctions in fixtures.
# Listed explicitly rather than via a regex back-reference because not every
# git-secrets build supports back-refs in its allowlist regexes.
000000000000
111111111111
222222222222
333333333333
444444444444
555555555555
666666666666
777777777777
888888888888
999999999999

# Group-block placeholders used in cmd/helpers_test.go variants and
# cmd/multi_service_helpers_test.go.
111222333444
555666777888
999888777666
# Descending-step fixture added in #956 tests (store_postgres_pgxmock_test.go,
# handler_analytics_test.go, handler_history_test.go, handler_dashboard_test.go).
999988887777
# Repeating-pair-block fixture used in handler_analytics_test.go,
# handler_inventory_test.go, store_postgres_pgxmock_test.go.
111122223333

# UUID-shaped account ID used in handler_accounts_test.go (synthetic, not a
# real subscription/account).
11111111-1111-1111-1111-111111111111

# scripts/setup-git-secrets.sh registers its detectors as literal regex text
# and three of them (Azure connection string, PostgreSQL and MySQL DSN
# detectors, verified empirically -- MongoDB's does not) match their own
# registration line. Each entry below is anchored on the path, the line
# number, AND the entire line as it appears in that file (including the
# trailing comment), with a trailing $ -- not just the "git secrets --add
# '" command prefix, and not just the added pattern with the anchor left
# open at the end. A prefix-only anchor whitelists a secret appended to
# ANY registration line in this file; an anchor missing the trailing $
# whitelists a secret appended to the END of one of these three specific
# lines. Both are the #1972 hole reintroduced at a smaller scale, and both
# were caught only by a fixture exercising exactly that mutation -- add
# one for any future entry in this block that isn't already covered.
#
# Each entry below also replaces one letter of its own trigger substring
# with a single-character bracket expression, e.g. "Protoco[l]" for
# "Protocol". This is a no-op for matching (as a regex, [l] matches the
# literal letter l exactly like l would) but it breaks the contiguous
# trigger span each entry is built from, so .gitallowed does not need to
# allow-list ITSELF against the very patterns these entries exist to
# suppress (confirmed empirically: without this, the .gitallowed
# self-scan case below fails -- and note this comment must not spell any
# of those spans out literally either, for the same reason).
^scripts/setup-git-secrets\.sh:[0-9]+:add_pattern 'DefaultEndpointsProtoco[l]=https'                      # Azure Connection String$
^scripts/setup-git-secrets\.sh:[0-9]+:add_pattern 'postgre[s]://\[\^:\]\+:\[\^@\]\+@'                           # PostgreSQL$
^scripts/setup-git-secrets\.sh:[0-9]+:add_pattern 'mysq[l]://\[\^:\]\+:\[\^@\]\+@'                              # MySQL$

# Truncated PEM placeholder used by scripts/test-git-secrets-allowlist.sh
# (and by any fixture in this repo needing a non-secret PEM-shaped string):
# a PEM header immediately followed by "\n..." (optionally with a short
# base64 prefix) is never a real key body, so a line consisting of EXACTLY
# a "PrivateKey:" or "private_key" assignment to that shape is safe.
#
# Anchored on the WHOLE scanner output line, not just the quoted value:
# .gitallowed suppresses a line if ANY allowed pattern matches anywhere in
# it, regardless of which prohibited pattern fired, so a real secret in an
# earlier, unrelated statement on the same physical line as this entry's
# fixture would otherwise be suppressed too, even though the entry has
# nothing to do with that secret (a fixture below exercises exactly this:
# a key assigned before the fixture, on the same scanner line, must still
# be caught -- note this comment must not spell the fixture out as a
# literal contiguous string either, for the same self-scan reason).
# ^[^:]+:[0-9]+: pins the match to the start of git-secrets' own
# "path:line:content" format, so the key assignment must be the first thing
# on the line (only leading whitespace allowed), and the trailing $ pins the
# tail to only the closing quote/comma this repo's fixtures actually use.
# Both ends are load-bearing -- do not loosen either back to an open match.
#
# One letter of "PRIVATE" is bracketed for the same self-scan reason the
# block above explains -- do not tidy it back to a bare word.
^[^:]+:[0-9]+:[[:space:]]*("private_key"|PrivateKey):[[:space:]]*"-----BEGIN PRIVAT[E] KEY-----\\n(MIIEvQIBADANBg)?\.\.\.(\\n)?",?$