Ons/.gitguardian.yml at main · GravityDarkLab/Ons · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
version: 2

# Allowlist for ggshield / GitGuardian GitHub App.
# All entries below are dev-only defaults or test fixtures — never real credentials.

# Smoke tests contain fixture passwords (e.g. "wrong-password", "definitely-wrong",
# dynamic template literals) used purely for negative-test cases. Real config is
# read from tests/smoke/.env.smoke which is gitignored and never committed.
paths-ignore:
  - "tests/smoke/**"

ignore-secrets:
  # ── Docker dev defaults ──────────────────────────────────────────────────────
  - match: "matching_app_dev_password"
    name: "legacy dev default MongoDB app password (docker-compose)"
  - match: "ons_app_dev_password"
    name: "dev default MongoDB app password (docker-compose)"
  - match: "devadmin_password"
    name: "dev default mongo-express password (docker-compose)"

  # ── Test fixtures (api/src/__tests__/setup.ts) ───────────────────────────────
  - match: "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
    name: "test-only AES-256 key placeholder (64 repeated chars, not a real key)"
  - match: "super-secret-jwt-key-for-testing-only"
    name: "test-only JWT secret"
  - match: "form-secret-hex-string-for-testing-purposes-only-64chars-padding"
    name: "test-only HMAC form secret"

  # ── Staging example placeholders (.env.example files) ───────────────────────
  - match: "changeme_staging_app"
    name: "staging env example placeholder"
  - match: "changeme_express"
    name: "staging env example placeholder"
  - match: "changeme_staging"
    name: "staging env example placeholder"