ci: CI-gate gitleaks (scan secrets au push)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-07-22 23:04:58 +02:00
parent 29bda37948
commit d2f79c049b
2 changed files with 44 additions and 0 deletions
@@ -0,0 +1,27 @@
+title = "homelab"
+[extend]
+useDefault = true
+[[rules]]
+id = "groq-key"
+description = "Groq API key"
+regex = '''gsk_[A-Za-z0-9]{20,}'''
+[[rules]]
+id = "plane-key"
+description = "Plane API key"
+regex = '''plane_api_[A-Za-z0-9]{10,}'''
+[[rules]]
+id = "vault-token"
+description = "Vault token"
+regex = '''hvs\.[A-Za-z0-9_-]{15,}'''
+[[rules]]
+id = "hex40-token-ctx"
+description = "40-hex token in credential context (Gitea etc.)"
+regex = '''(?i)(?:tok|token|secret|key|auth|bearer|pass|pwd)['"=: ]{0,12}([a-f0-9]{40})'''
+[allowlist]
+description = "vendored / lock / build artifacts"
+paths = [
+  '''.*\.min\.(js|css)$''',
+  '''.*-lock\.json$''',
+  '''.*\.lock$''',
+  '''(^|/)(vendor|dist|node_modules|build|three\.min|mermaid\.min)''',
+]