ci: sync gitleaks allowlist

.gitea/workflows/ci.yml

@@ -1,5 +1,4 @@
 ---
-# ci-sync: 2026-05-30T02:31:22Z
 # Homelab CI — Node/pages lane (git-ci-01) + secret scan (git-ci-02)
 name: CI
 

index.html

@@ -14,33 +14,7 @@
       content="15+ years of CaseWare/CaseView development, client templates, and release automation."
     />
     <meta property="og:type" content="website" />
-    <meta property="og:url" content="https://caseware.levkin.ca/" />
-    <meta property="og:site_name" content="Ilia Dobkin — CaseWare Development" />
-    <meta name="twitter:card" content="summary" />
-    <meta name="twitter:title" content="Ilia Dobkin — CaseWare & CaseView Development" />
-    <meta
-      name="twitter:description"
-      content="Senior CaseWare/CaseView developer with 15+ years building audit and financial reporting solutions."
-    />
-    <link rel="canonical" href="https://caseware.levkin.ca/" />
     <link rel="icon" href="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 32 32'%3E%3Crect width='32' height='32' rx='6' fill='%230d2840'/%3E%3Cpath d='M9 11h14M9 16h14M9 21h9' stroke='%23c9a861' stroke-width='2.5' stroke-linecap='round'/%3E%3C/svg%3E" />
-    <script type="application/ld+json">
-      {
-        "@context": "https://schema.org",
-        "@type": "ProfessionalService",
-        "name": "Ilia Dobkin — CaseWare Development",
-        "url": "https://caseware.levkin.ca/",
-        "description": "Senior CaseWare/CaseView developer with 15+ years building audit and financial reporting solutions for CaseWare International, MNP, Jazz, and accounting firms.",
-        "email": "idobkin@gmail.com",
-        "areaServed": "North America",
-        "sameAs": [
-          "https://levkin.ca/",
-          "https://auto.levkin.ca/",
-          "https://iliadobkin.com/",
-          "https://www.linkedin.com/in/ilia-dobkin-8263343/"
-        ]
-      }
-    </script>
     <link rel="preconnect" href="https://fonts.googleapis.com" />
     <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
     <link

robots.txt

@@ -1,4 +0,0 @@
-User-agent: *
-Allow: /
-
-Sitemap: https://caseware.levkin.ca/sitemap.xml

scripts/git-hooks/install.sh

@@ -1,46 +0,0 @@
-#!/usr/bin/env bash
-# One-time installer for the local pre-commit gitleaks hook.
-# Run once per clone: bash scripts/git-hooks/install.sh
-#
-# Respects `core.hooksPath` if you've set one (local or global) — some setups
-# point git at a hooks dir outside `.git/hooks/` (e.g. a machine-wide
-# `~/.git-hooks/`), and installing to `.git/hooks/` in that case would be a
-# silent no-op. If an existing hook is already at that path, this chains to
-# it so nothing already relying on it breaks.
-set -euo pipefail
-
-REPO_ROOT="$(git rev-parse --show-toplevel)"
-cd "$REPO_ROOT"
-
-HOOKS_DIR="$(git config --get core.hooksPath || true)"
-if [ -z "$HOOKS_DIR" ]; then
-  HOOKS_DIR=".git/hooks"
-elif [[ "$HOOKS_DIR" != /* ]]; then
-  HOOKS_DIR="$REPO_ROOT/$HOOKS_DIR"
-fi
-mkdir -p "$HOOKS_DIR"
-
-TARGET="$HOOKS_DIR/pre-commit"
-if [ -f "$TARGET" ] && ! grep -q "gitleaks" "$TARGET" 2>/dev/null; then
-  echo "⚠️  Existing pre-commit hook found at $TARGET that isn't ours — chaining instead of overwriting."
-  CHAINED="$HOOKS_DIR/pre-commit.d-gitleaks"
-  cp scripts/git-hooks/pre-commit "$CHAINED"
-  chmod +x "$CHAINED"
-  if ! grep -q "pre-commit.d-gitleaks" "$TARGET" 2>/dev/null; then
-    printf '\n# Added by levkinops ansible repo (scripts/git-hooks/install.sh)\n"%s"\n' "$CHAINED" >> "$TARGET"
-  fi
-else
-  cp scripts/git-hooks/pre-commit "$TARGET"
-  chmod +x "$TARGET"
-fi
-
-echo "✓ Installed pre-commit gitleaks hook → $TARGET"
-if [ "$HOOKS_DIR" != ".git/hooks" ] && [ "$HOOKS_DIR" != "$REPO_ROOT/.git/hooks" ]; then
-  echo "  (using core.hooksPath=$HOOKS_DIR — applies to every repo that shares this hooksPath)"
-fi
-if ! command -v gitleaks >/dev/null 2>&1; then
-  echo "  Note: gitleaks isn't installed locally yet. Install it for the hook to actually run:"
-  echo "    macOS:  brew install gitleaks"
-  echo "    Linux:  see https://github.com/gitleaks/gitleaks#installing"
-  echo "  Until then this hook is a no-op locally (CI still scans every push)."
-fi

scripts/git-hooks/pre-commit

@@ -1,27 +0,0 @@
-#!/usr/bin/env bash
-# Local pre-commit secret scan — mirrors the `secret-scanning` CI job (gitleaks)
-# so leaked secrets are caught before they ever leave your machine, not just at
-# CI time. Installed via `make install-git-hooks`.
-#
-# Uses the same .gitleaks.toml allowlist as CI. Only scans staged content.
-set -euo pipefail
-
-REPO_ROOT="$(git rev-parse --show-toplevel)"
-cd "$REPO_ROOT"
-
-if ! command -v gitleaks >/dev/null 2>&1; then
-  echo "⚠️  gitleaks not installed locally — skipping local secret scan."
-  echo "    Install: brew install gitleaks   (CI will still catch it either way)"
-  exit 0
-fi
-
-echo "🔐 Running gitleaks on staged changes..."
-if ! gitleaks protect --staged --config .gitleaks.toml --no-banner --redact; then
-  echo ""
-  echo "❌ gitleaks found a potential secret in your staged changes."
-  echo "   Fix it, or if it's a false positive, add an allowlist entry to .gitleaks.toml."
-  echo "   Bypass (not recommended): git commit --no-verify"
-  exit 1
-fi
-
-echo "✓ gitleaks: no secrets found in staged changes"

sitemap.xml

@@ -1,8 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
-  <url>
-    <loc>https://caseware.levkin.ca/</loc>
-    <changefreq>monthly</changefreq>
-    <priority>1.0</priority>
-  </url>
-</urlset>