.gitallowed

# git-secrets allowlist: regexes that should NOT trigger the AWS-secret scanner.
#
# The scanner's `--register-aws` adds a 12-digit account-ID pattern that
# matches our test fixtures. The values below are obvious test placeholders
# (sequential 123456789012, all-same-digit blocks like 111111111111, and
# countdown patterns like 999888777666) — chosen specifically because they
# cannot be real customer accounts. Adding these is safer than disabling the
# AWS-account check entirely.
#
# DO NOT add a real account ID here. If a real account ID lands in the repo,
# rotate it and treat the leak seriously instead of silencing the scanner.
#
# Format: one regex per line, matched against the scanner's whole
# "path:line:content" output line (not just the file content), so an entry
# may anchor on the path with "^path:[0-9]+:". Every entry must still be a
# synthetic literal or one known benign line, never a bare keyword: a
# keyword whitelists every line that happens to contain it (#1972).

# scripts/setup-git-secrets.sh registers its detectors as literal regex text
# and three of them (Azure connection string, PostgreSQL and MySQL DSN
# detectors, verified empirically -- MongoDB's does not) match their own
# registration line. Each entry below is anchored on the path, the line
# number, AND the entire line as it appears in that file (including the
# trailing comment), with a trailing $ -- not just the "git secrets --add
# '" command prefix, and not just the added pattern with the anchor left
# open at the end. A prefix-only anchor whitelists a secret appended to
# ANY registration line in this file; an anchor missing the trailing $
# whitelists a secret appended to the END of one of these three specific
# lines. Both are the #1972 hole reintroduced at a smaller scale, and both
# were caught only by a fixture exercising exactly that mutation -- add
# one for any future entry in this block that isn't already covered.
#
# Each entry below also replaces one letter of its own trigger substring
# with a single-character bracket expression, e.g. "Protoco[l]" for
# "Protocol". This is a no-op for matching (as a regex, [l] matches the
# literal letter l exactly like l would) but it breaks the contiguous
# trigger span each entry is built from, so .gitallowed does not need to
# allow-list ITSELF against the very patterns these entries exist to
# suppress (confirmed empirically: without this, the .gitallowed
# self-scan case below fails -- and note this comment must not spell any
# of those spans out literally either, for the same reason).
^scripts/setup-git-secrets\.sh:[0-9]+:git secrets --add 'DefaultEndpointsProtoco[l]=https'                      # Azure Connection String$
^scripts/setup-git-secrets\.sh:[0-9]+:git secrets --add 'postgre[s]://\[\^:\]\+:\[\^@\]\+@'                           # PostgreSQL$
^scripts/setup-git-secrets\.sh:[0-9]+:git secrets --add 'mysq[l]://\[\^:\]\+:\[\^@\]\+@'                              # MySQL$

# Truncated PEM placeholder used by scripts/test-git-secrets-allowlist.sh
# (and by any fixture in this repo needing a non-secret PEM-shaped string):
# a PEM header immediately followed by "\n..." (optionally with a short
# base64 prefix) is never a real key body, so a line consisting of EXACTLY
# a "PrivateKey:" or "private_key" assignment to that shape is safe.
#
# Anchored on the WHOLE scanner output line, not just the quoted value:
# .gitallowed suppresses a line if ANY allowed pattern matches anywhere in
# it, regardless of which prohibited pattern fired, so a real secret in an
# earlier, unrelated statement on the same physical line as this entry's
# fixture would otherwise be suppressed too, even though the entry has
# nothing to do with that secret (a fixture below exercises exactly this:
# a key assigned before the fixture, on the same scanner line, must still
# be caught -- note this comment must not spell the fixture out as a
# literal contiguous string either, for the same self-scan reason).
# ^[^:]+:[0-9]+: pins the match to the start of git-secrets' own
# "path:line:content" format, so the key assignment must be the first thing
# on the line (only leading whitespace allowed), and the trailing $ pins the
# tail to only the closing quote/comma this repo's fixtures actually use.
# Both ends are load-bearing -- do not loosen either back to an open match.
#
# One letter of "PRIVATE" is bracketed for the same self-scan reason the
# block above explains -- do not tidy it back to a bare word.
^[^:]+:[0-9]+:[[:space:]]*("private_key"|PrivateKey):[[:space:]]*"-----BEGIN PRIVAT[E] KEY-----\\n(MIIEvQIBADANBg)?\.\.\.(\\n)?",?$

# Benign lines the setup script's 40-character-run detector and PEM
# detector flag in this repo's tree: separator rules and box-drawing log
# banners (no letters or digits), and truncated or placeholder PEM literals
# in two test files. Each is anchored on path and the entire line, with a
# bracketed letter in PRIVAT[E] for the same self-scan reason as above.
^(SECURITY\.md|\.github/workflows/README\.md):[0-9]+:\|[-| ]+\|$
^cmd/[a-z_]+\.go:[0-9]+:[[:space:]]*(fmt|AppLogger)\.Println\("-+"\)$
^cmd/multi_service(_helpers)?\.go:[0-9]+:[[:space:]]*AppLogger\.Printf\("(\\n)?(━)+\\n"\)$
^cmd/configure_gcp_test\.go:[0-9]+:// --- addMemberToPolicyBinding -+$
^cmd/configure_test\.go:[0-9]+:[[:space:]]*assert\.Equal\(t, "-----BEGIN PRIVAT[E] KEY-----\\n\.\.\.", creds\.PrivateKey\)$
^cmd/configure_test\.go:[0-9]+:[[:space:]]*"private_key": "-----BEGIN PRIVAT[E] KEY-----\\nMIIEvQIBADANBg\.\.\.\\n-----END PRIVATE KEY-----\\n",$
^cmd/configure_gcp_test\.go:[0-9]+:[[:space:]]*keyMaterial := \[\]byte\(`\{"type":"service_account","project_id":"proj","client_email":"sa@proj\.iam\.gserviceaccount\.com","private_key":"-----BEGIN PRIVAT[E] KEY-----\\nx\\n-----END PRIVATE KEY-----\\n"\}`\)$

# Synthetic 12-digit account-ID fixtures (sequential or repeated-digit
# blocks, none a real account) that the AWS account-ID detector flags in Go
# test tables. Each entry pins the path, the placeholder digits and the
# whole line, so anything else on the line is still scanned.
^cmd/(helpers_test|multi_service_filters_test|multi_service_test)\.go:[0-9]+:[[:space:]]*(accountID|Account):[[:space:]]*"(123456789012|999888777666|111222333444)",$
^cmd/multi_service_helpers_test\.go:[0-9]+:[[:space:]]*\{Account: "(123456789012|210987654321|111222333444|555666777888)", AccountName: ""\},( // Same account - should use cache)?$
^cmd/savings_plan_purchase_test\.go:[0-9]+:[[:space:]]*(Service: common\.ServiceSavingsPlansCompute, )?(Count: 1, )?Account: "11111111111[1]", Term: "1yr", PaymentOption: "no-upfront",$
^cmd/savings_plan_purchase_test\.go:[0-9]+:[[:space:]]*"account": func\(r \*common\.Recommendation\) \{ r\.Account = "22222222222[2]" \},$