From 5df99bf27d439778b21ee7663a7ccbce2e2a77a3 Mon Sep 17 00:00:00 2001
From: TheAbider <51920546+TheAbider@users.noreply.github.com>
Date: Mon, 3 Aug 2026 15:40:17 -0700
Subject: [PATCH] ci: allowlist two verified gitleaks false positives

The weekly full-history gitleaks scan has failed every Monday since at
least 2026-05-25, always on the same two findings. Neither is a
credential:

- Tests/Pester/Logging.Tests.ps1 uses 'sk_live_abcd1234' as the fixture
  for the test asserting Write-StructuredLog redacts keys named "Token".
  The assertion is that the value does not reach the log file.
- docs/fileserver-docker.md shows readers the shape of a Cloudflare
  tunnel token. The base64 payload decodes to
  {"a":"abcdef...","t":"a1b2c3d4...","s":"ABCDEF..."} -- literal
  ellipses, no live tunnel.

A permanently red secret scanner is worse than no scanner, because a
genuine leak arrives as "3 findings" in a job everyone has learned to
skip. The push and pull_request runs stay green because they only scan
new commits, so the weekly job was the only one reporting and it was
reporting noise.

Allowlist both by exact literal value rather than by path or commit, so
a real secret added to either file still fails the scan.

Note the singular [allowlist] table. gitleaks 8.24.3 silently ignores
the plural [[allowlists]] array at global scope -- it parses without
error and suppresses nothing -- and because push/PR runs skip history, a
broken allowlist would not surface until the following Monday. The file
carries a maintenance warning to that effect.

Verified locally with gitleaks 8.24.3 over all 589 commits: 2 findings
before, 0 after, and a planted secret in an allowlisted file still
fails the scan.
---
 .gitleaks.toml | 58 ++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 58 insertions(+)
 create mode 100644 .gitleaks.toml

diff --git a/.gitleaks.toml b/.gitleaks.toml
new file mode 100644
index 0000000..1868813
--- /dev/null
+++ b/.gitleaks.toml
@@ -0,0 +1,58 @@
+# gitleaks configuration for RackStack
+#
+# Extends the built-in gitleaks ruleset (AWS, GitHub, Slack, GCP, Stripe,
+# private keys, ...) and suppresses two verified false positives.
+#
+# Why this file exists
+# --------------------
+# The weekly `schedule` run in .github/workflows/gitleaks.yml scans the FULL
+# git history, so it re-reports every historical finding on every run. Two
+# non-secrets in old commits failed that job every Monday from 2026-05-25
+# onward, which trains maintainers to ignore a security alert -- the exact
+# condition under which a real leak gets missed. They are allowlisted here so
+# the job is green when the repo is clean and red only when it is not.
+#
+# Scope
+# -----
+# Each entry allowlists one exact literal value, NOT a file and NOT a commit.
+# A real credential added to either of these files, in any future commit, has
+# a different value and still fails the scan. Do not relax these into `paths`
+# or `commits` entries -- that would blind the scanner to entire files.
+#
+# Both values below are fake and have been public in this repository's history
+# since 2026-02-23 and 2026-05-20 respectively; repeating them here discloses
+# nothing.
+#
+# !! MAINTENANCE WARNING !!
+# Use the SINGULAR [allowlist] table below. gitleaks 8.24.3 silently ignores
+# the plural [[allowlists]] array at global scope: it parses without error,
+# reports no warning, and suppresses nothing. Verified empirically on
+# 8.24.3 -- [[allowlists]] returned "leaks found: 2", [allowlist] returned
+# "no leaks found". Because the push/pull_request runs only scan new commits,
+# a broken allowlist here stays invisible until the weekly full-history scan
+# fails. If you change this file, re-verify with a full scan:
+#
+#     gitleaks detect --source . --redact -v --exit-code=2
+
+[extend]
+useDefault = true
+
+[allowlist]
+description = "Verified false positives -- see per-entry notes below (reviewed 2026-08-03)"
+regexes = [
+  # Tests/Pester/Logging.Tests.ps1 -- Pester fixture, not a credential.
+  # The test asserts that Write-StructuredLog redacts data keys named "Token".
+  # The value is deliberately Stripe-shaped so the test is meaningful, and the
+  # assertion is that it does NOT reach the log file:
+  #     Write-StructuredLog -Message 'auth' -Data @{ Token = 'sk_live_abcd1234' }
+  #     (Read-LogContent $script:logPath) | Should -Not -Match 'sk_live_abcd1234'
+  # Sibling cases use 'hunter2-plaintext' and 'topsecret-xyz'. Added in 1a052069.
+  '''sk_live_abcd1234''',
+
+  # docs/fileserver-docker.md -- documentation placeholder, not a credential.
+  # Shows readers the shape of a Cloudflare tunnel token. The base64 payload
+  # decodes to {"a":"abcdef...","t":"a1b2c3d4...","s":"ABCDEF..."} -- literal
+  # ellipses, no live tunnel, no account identifier. The next line of that doc
+  # reads "Never commit `.env` to version control." Added in 52574abb.
+  '''eyJhIjoiYWJjZGVmLi4uIiwidCI6ImExYjJjM2Q0Li4uIiwicyI6IkFCQ0RFRi4uLiJ9''',
+]