# gitleaks config for the jepa-fx-risk repo (infra#317).
#
# Runs gitleaks' full default ruleset and allowlists one non-credential
# constant, scoped by BOTH path and pattern (condition = "AND") so a different
# secret in the same files still fires. Allowlist by shape, not by filename.

title = "jepa-fx-risk gitleaks config"

[extend]
useDefault = true

# METRIC_KEY is the metrics-pipeline identifier
# ("VaR_breach_rate_99_oos_regime_cond") that train.py's VaR eval block writes
# into metrics.json -- documented in var_breach.py's own comment. It trips
# generic-api-key purely because the variable name ends in _KEY and the value
# is long and mixed-case enough to pass the entropy heuristic. It is not a
# credential and has no secret analogue.
[[allowlists]]
description = "infra#317 — METRIC_KEY is a metrics identifier, not a credential"
condition = "AND"
regexTarget = "line"
paths = [
  '''(^|/)scripts/var_breach\.py$''',
  '''(^|/)tests/test_var_metric\.py$''',
]
regexes = ['''METRIC_KEY''']