From 128e446266be6046b1e3f8c9d19bbec3e7279f2d Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Tue, 6 Oct 2026 14:04:40 +0100
Subject: [PATCH] fix(ci): stop gitleaks flagging the estate baseline the
 scanner stages itself
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The standards secret-scanner reusable copies the estate gitleaks baseline
to `.gitleaks-estate.toml` at the workspace root unconditionally, before
the step that decides whether this repo references it
(hyperpolymath/standards#888). The baseline documents credential shapes,
so `generic-api-key` fires on it and the required `scan / gitleaks` gate
has been red on main for reasons no commit here caused: run 37440882742
on 3c3f2621 reports 4 findings, all on `.gitleaks-estate.toml`.

Allowlist that one path, anchored root-only, so a nested copy anywhere
else in the tree is still scanned. Same cure as boj-server-cartridges#155.

Verified locally with the CI-identical command (`gitleaks detect --no-git
--redact --config .gitleaks.toml --exit-code 1`) with the baseline staged
at the root: 4 leaks before, 0 after; a copy planted at
`src/.gitleaks-estate.toml` is still caught (4 findings), so the anchor
does not blind the scanner.

Ratchet-exception: .gitleaks.toml — the single new paths entry is the scanner's own staged artefact (`^\.gitleaks-estate\.toml$`, root-only), not an exemption for any file in this repository; remove it once hyperpolymath/standards#888 lands and the caller pin is bumped past it

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0144BSwhFVjj4EJ2u7Y2VHWf
---
 .gitleaks.toml | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/.gitleaks.toml b/.gitleaks.toml
index db763a2c..bf6d1568 100644
--- a/.gitleaks.toml
+++ b/.gitleaks.toml
@@ -52,6 +52,26 @@ paths = [
   # registry, which trip the generic-api-key entropy heuristic.
   '''(^|/)Project\.toml$''',
   '''(^|/)Manifest\.toml$''',
+
+  # The SCANNER'S OWN STAGED ARTEFACT -- not an exemption for a file that
+  # "is fine", which the DESIGN RULE above forbids, but the one file the
+  # scanner writes into its own scan target.
+  #
+  # The standards secret-scanner reusable copies
+  # `config/gitleaks/estate-baseline.toml` to `.gitleaks-estate.toml` in the
+  # workspace root UNCONDITIONALLY, before the step that decides whether this
+  # repo references it (hyperpolymath/standards#888). That baseline documents
+  # worked examples of credential SHAPES, so `generic-api-key` fires on it and
+  # the required `scan / gitleaks` gate goes red for reasons no commit here
+  # caused (4 findings, all on `.gitleaks-estate.toml`, run 37440882742).
+  #
+  # Anchored `^...$` -- ROOT ONLY. A path regex matches a BASENAME AT ANY
+  # DEPTH unless anchored, so `(^|/)` would also blind the scanner to a real
+  # `src/.gitleaks-estate.toml`. The reusable only ever writes the file at the
+  # root, so root-only is exact. Same cure as boj-server-cartridges#155 and
+  # metadatastician/IDApTIK#127; remove once standards#888 lands and the
+  # caller pin is bumped past it.
+  '''^\.gitleaks-estate\.toml$''',
 ]
 
 regexes = [