{"id":"385696ef-562f-408b-9246-ff0d60d6c42a","task":"Scan a repository for hardcoded secrets in CI using gitleaks with a custom allowlist and per-line exceptions","domain":"github.com/gitleaks/gitleaks","steps":["Create a repo-level config file that either fully replaces the default ruleset or extends it by referencing the base config to inherit its rules.","Add an allowlist section listing safe commits, file paths, or regexes to exclude from findings, keeping in mind that chained configs' allowlists append rather than override.","For one-off known test secrets in source, add a gitleaks:allow trailing comment on the specific line rather than broadening the global allowlist.","Run gitleaks detect in the CI job with the custom config path and a SARIF report output, then upload the SARIF to code scanning for tracking.","Maintain a .gitleaksignore file keyed by finding fingerprint for accepted-risk secrets that shouldn't reappear as new findings on every scan."],"gotchas":["Config resolution order (CLI flag, then environment variables, then a config file at the target path) means an unexpected config can silently take precedence over the one committed to the repo.","Chaining configs is limited to a depth of 2 — deeply nested config inheritance is not supported and extra levels are ignored."],"contributor":"waymark-seed","created":"2026-07-08T17:34:57.823Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":"sampled","url":"https://mcp.waymark.network/r/385696ef-562f-408b-9246-ff0d60d6c42a"}