From db7929cb839eaebb5ecc281ca0c06f4dbd9d10a4 Mon Sep 17 00:00:00 2001 From: "efemena.arah" Date: Wed, 29 Jul 2026 17:20:18 +0100 Subject: [PATCH] Remove plugin-added comment from secret-scanner rules The migration tooling added an explanatory comment above the allowlist entries. It quoted a real internal value, and gitleaks scans comment text as content, so this file reported itself as a leak - failing the Secrets Scanner check on the commit that introduced it. The file now carries only what upstream ships plus the allowlist entries the migration guide requires. Co-Authored-By: Claude Opus 5 (1M context) --- .../secret-scanner/gitleaks-custom-rules-template.toml | 8 -------- 1 file changed, 8 deletions(-) diff --git a/.github/actions/secret-scanner/gitleaks-custom-rules-template.toml b/.github/actions/secret-scanner/gitleaks-custom-rules-template.toml index 2286071..a684cf7 100644 --- a/.github/actions/secret-scanner/gitleaks-custom-rules-template.toml +++ b/.github/actions/secret-scanner/gitleaks-custom-rules-template.toml @@ -15,14 +15,6 @@ description = "Identify banned IDs" regex = '''${GITLEAKS_REGEX_BANNED_IDS}''' tags = ["banned-ids"] -# --------------------------------------------------------------------------- -# Reviewed and accepted values. Each entry is matched against a finding's -# secret, so only these exact values are excluded - the rules above still -# apply everywhere else. -# - "vnd..query.local" HTTP media types, which are content-type -# identifiers rather than hostnames (only the trailing ".local" matches) -# - user-id UUIDs used by the test fixtures under projects/testing -# --------------------------------------------------------------------------- [allowlist] description = "Accepted values" regexes = [