# SPDX-License-Identifier: GPL-3.0-or-later
# SPDX-FileCopyrightText: 2025 ai-ad4 and the FreePDFEditor contributors
# gitleaks config (§13.2 rule 4). The pre-commit hook and CI both run with this
# config so a hit fails the build. Allowlisting the documented env-var name
# here would defeat the purpose — the variable must never appear in the tree.
# Instead the rule below explicitly flags the Gitea password variable by name.

title: "FreePDFEditor gitleaks config"

# Extend the default ruleset bundled with gitleaks.
extend: default

# Allowlist: paths we never want scanned (corpora, vendored third-party that
# is itself pinned by vcpkg, and the license texts).
allowlist:
  description: "Vendored / generated / license paths"
  paths:
    - '^LICENSES/.*'
    - '^vcpkg/.*'
    - '^build/.*'
    - '^vcpkg_installed/.*'

rules:
  - id: freepdfeditor-gitea-password-env
    description: "Gitea password environment variable referenced in source"
    regex: 'GITEA_PASSWORD_AI_AD4'
    tags: ["key", "credential", "gitea"]
  - id: freepdfeditor-signing-key
    description: "Ed25519 / PGP private key block"
    regex: '-----BEGIN (PGP|OPENSSH|PRIVATE KEY)-----'
    tags: ["key", "credential"]