31 lines
1.2 KiB
TOML
31 lines
1.2 KiB
TOML
# SPDX-License-Identifier: GPL-3.0-or-later
|
|
# SPDX-FileCopyrightText: 2025 ai-ad4 and the FreePDFEditor contributors
|
|
# gitleaks config (§13.2 rule 4). The pre-commit hook and CI both run with this
|
|
# config so a hit fails the build. Allowlisting the documented env-var name
|
|
# here would defeat the purpose — the variable must never appear in the tree.
|
|
# Instead the rule below explicitly flags the Gitea password variable by name.
|
|
|
|
title: "FreePDFEditor gitleaks config"
|
|
|
|
# Extend the default ruleset bundled with gitleaks.
|
|
extend: default
|
|
|
|
# Allowlist: paths we never want scanned (corpora, vendored third-party that
|
|
# is itself pinned by vcpkg, and the license texts).
|
|
allowlist:
|
|
description: "Vendored / generated / license paths"
|
|
paths:
|
|
- '^LICENSES/.*'
|
|
- '^vcpkg/.*'
|
|
- '^build/.*'
|
|
- '^vcpkg_installed/.*'
|
|
|
|
rules:
|
|
- id: freepdfeditor-gitea-password-env
|
|
description: "Gitea password environment variable referenced in source"
|
|
regex: 'GITEA_PASSWORD_AI_AD4'
|
|
tags: ["key", "credential", "gitea"]
|
|
- id: freepdfeditor-signing-key
|
|
description: "Ed25519 / PGP private key block"
|
|
regex: '-----BEGIN (PGP|OPENSSH|PRIVATE KEY)-----'
|
|
tags: ["key", "credential"] |