From 3969a74850a2637e7dd6eb5753b0c19e48d14bef Mon Sep 17 00:00:00 2001
From: ilia <idobkin@gmail.com>
Date: Fri, 29 May 2026 21:20:08 -0500
Subject: [PATCH] ci: add homelab gitleaks allowlist

---
 .gitleaks.toml | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)
 create mode 100644 .gitleaks.toml

diff --git a/.gitleaks.toml b/.gitleaks.toml
new file mode 100644
index 0000000..3587bd4
--- /dev/null
+++ b/.gitleaks.toml
@@ -0,0 +1,19 @@
+# Homelab bootstrap — gitleaks allowlist (tests, examples, placeholders)
+title = "homelab gitea bootstrap"
+
+[allowlist]
+description = "Test fixtures and example configs are not production secrets"
+paths = [
+  '''(?i).*\.test\.(ts|tsx|js|jsx|py)$''',
+  '''(?i).*\.spec\.(ts|tsx|js|jsx)$''',
+  '''(?i).*/tests/.*''',
+  '''(?i).*/__tests__/.*''',
+  '''(?i).*\.example\.(yml|yaml|env|json|toml)$''',
+  '''(?i).*vault\.example\.(yml|yaml)$''',
+  '''(?i).*\.env\.example$''',
+]
+regexes = [
+  '''(?i)(invalid|fake|dummy|placeholder|example|changeme|change_me|not-a-real)''',
+  '''(?i)sk-or-invalid''',
+  '''(?i)msk-or-invalid''',
+]