# ────────────────────────────────────────────────────────────────────────────
# gitleaks config — maple-brief commit gate (secret stage)
#
# Policy (fail-closed): the FULL default gitleaks ruleset (every known
# provider / secret shape) hard-blocks at commit and pre-push. The ONLY
# suppression is a tight, content-regexed allowlist scoped to a single file:
# .env.example (the committed placeholder template). It suppresses ONLY those
# exact placeholder lines. A real composite key pasted there (or anywhere)
# STILL fires — verified on gitleaks 8.30.1 (linux x64).
#
# Gotchas found while validating (do not regress):
#   • allowlist must be a MAP  [allowlist]  — a slice [[allowlist]] fails
#     with "expected a map, got slice"
#   • an embedded single quote inside a single-quoted (literal) TOML string
#     silently closes it — keep regex strings double-quoted (basic)
#   • paths= scopes the suppression to the file; regexes= to the lines
# ────────────────────────────────────────────────────────────────────────────
[extend]
useDefault = true

[allowlist]
description = "Suppress ONLY empty double-quoted placeholder values and the change-me example, in the .env template"
paths = ['\.env\.example$']
regexes = [
  '^OPENAI_API_KEY=("")$',
  '^ANTHROPIC_API_KEY=("")$',
  '^NEXT_PUBLIC_ADSENSE_[A-Z_]+=("")$',
  "^ADMIN_API_KEY=\"change-me[^\"]*\"$"
]