# gitleaks config for the jepa-fx-risk repo (infra#317).
#
# Runs gitleaks' full default ruleset and allowlists one non-credential
# constant, scoped by BOTH path and pattern (condition = "AND") so a different
# secret in the same files still fires. Allowlist by shape, not by filename.

title = "jepa-fx-risk gitleaks config"

[extend]
useDefault = true

# METRIC_KEY is the metrics-pipeline identifier
# ("VaR_breach_rate_99_oos_regime_cond") that train.py's VaR eval block writes
# into metrics.json -- documented in var_breach.py's own comment. It trips
# generic-api-key purely because the variable name ends in _KEY and the value
# is long and mixed-case enough to pass the entropy heuristic. It is not a
# credential and has no secret analogue.
[[allowlists]]
description = "infra#317 — METRIC_KEY is a metrics identifier, not a credential"
# infra#344: `paths` removed. gitleaks ORs the clauses of a GLOBAL allowlist and
# does not honour `condition = "AND"` there, so the path matched on its own and
# granted the whole file immunity — every finding in it, not just this one.
# Verified: a live-shaped credential planted in that file scanned clean before
# this change and fires after it. The regex below is what was meant and works
# regardless of which file the value appears in (infra#256).
regexTarget = "line"
regexes = ['''METRIC_KEY''']