[Pigbibi]

Summary

Fix the P09 FIXTURE_OR_FALSE_POSITIVE findings under owner approval t1198s6751 option A. Only .gitleaks.toml changes.

Why

The findings documented by p09-gitleaks-fullhistory-r2/out/allowlist-proposal.txt require rule-specific path exceptions. The generic rule was inherited, so an incomplete local override would be invalid.

Changes

• Copy the complete upstream gitleaks v8.30.1 generic-api-key rule, including its description, regex, entropy, keywords and all four default allowlists (including stopwords), without modifying the upstream block.
• Append the approved Schwab and Firstrade path allowlists under that rule, and the approved Firstrade path allowlist under the existing json-credential-field rule.
• Preserve [extend] useDefault = true and every existing setting.

Testing

• Shared workflow installer and its pinned helper revision both specify gitleaks 8.30.1; local CLI reports 8.30.1.
• Upstream source: gitleaks/gitleaks tag v8.30.1, config/gitleaks.toml. The complete copied rule block is byte-identical to that source.
• Seven fake-only path cases: three exact approved paths suppressed for the intended rules; unrelated, prefixed and backup paths remain detected. Outside exceptions, generic and JSON rules both detect the fake credential. The candidate-expectation check fails on the baseline and passes on the candidate.
• Read-only scans of the retained full-history snapshots: Schwab 3 to 0 findings; Firstrade 5 to 0. These are historical fixture/false-positive findings, not proof of runtime adoption.
• All 9 secret scanner regression tests and 50 style tests pass; phase-2 documentation check has zero blocking findings and one existing advisory.
• Central repository scan-secrets.py dir check: zero findings. git diff --check: pass.

Risk and rollback

Path exceptions suppress future findings for the named rule and exact paths, including a real credential introduced there. Other rules remain active. Absolute-path directory scans do not match the anchored repository-relative exceptions. The shared workflow pins an earlier helper commit; this configuration PR does not update that pin or establish deployed adoption. Revert this configuration change to remove the exceptions. Keep Draft for the established review-and-merge bot.

Breaking changes

None.

Checklist

• This PR follows the documentation style guide.
• Configuration-only; no workflow, Secret, IAM, Variables or Environments changes.

AI assistance

Codex, GPT-6.1 (sol host).

Publication check

Checker publication-check/2.0-advisory, build 2947dd7867b4, advisory exit 0; total matches 35, matching lines 35. These are advisory matches, not credential findings. First 20 masked entries:

repo/.<PROJECT_ID>/CODEOWNERS:4: /.<PROJECT_ID>/CODEOWNERS @<PROJECT_ID>
repo/.<PROJECT_ID>/CODEOWNERS:5: /.<PROJECT_ID>/workflows/ @<PROJECT_ID>
repo/.<PROJECT_ID>/workflows/risk-gate.yml:79:                 approved = latest?.event === 'labeled' && latest.actor?.login === '<PROJECT_ID>';
repo/.gitleaks.toml:7: id = "<HOST>"
repo/.gitleaks.toml:18: description = "Only explicit <PROJECT_ID> JSON placeholders in the scanner fixture"
repo/AGENTS.md:75:   `gs://<bucket>/...` and `<account-id>`, and use <PROJECT_ID> values in
repo/docs/STYLE_GUIDE.md:163: | Dated status banners in a README | "<PROJECT_ID> source check: merged; acceptance pending" | Replace with a present-tense status sentence, or remove. Dated evidence records are separate. |
repo/docs/STYLE_GUIDE.md:387: # Console gap audit, <PROJECT_ID>
repo/docs/STYLE_GUIDE.md:446: > <PROJECT_ID> 源码核对：库与所选平台 adapter 已合并；生产数据可用性及交易周期验收另行确认。
repo/docs/adr/0001-incremental-architecture-boundaries.md:117: - Compare the baseline and candidate at the same boundary using fixed <PROJECT_ID>
repo/docs/architecture-conventions.md:175: consistent with the changed content, and use <PROJECT_ID> resource names in examples.
repo/docs/secret-scanning.md:63: It adds `<HOST>`, matching
repo/docs/secret-scanning.md:159: | `<PROJECT_ID>/PushPlusSmsToTelegram` | Intended `state` branch |
repo/docs/secret-scanning.md:160: | `<PROJECT_ID>/TelegramAutoSignBot` | `logs` branch |
repo/docs/secret-scanning.md:161: | `<PROJECT_ID>/GoogleVoicePulseBot` | `logs` branch |
repo/scripts/check_cross_repo_links.py:51:     "<PROJECT_ID>": ("repos", None),
repo/scripts/check_cross_repo_links.py:52:     "<PROJECT_ID>": ("repos", "<PROJECT_ID>"),
repo/scripts/check_cross_repo_links.py:72:             # <PROJECT_ID> and <PROJECT_ID> live in one directory; the name is what
repo/scripts/check_cross_repo_links.py:74:             is_gdei = path.name.startswith("<PROJECT_ID>")
repo/scripts/check_style.py:102: # finding. `<PROJECT_ID>-` is on the list because the organisation's fixtures are

[Pigbibi]

@codex review (exact head 3437c1e)

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-05T12:24:51.072445Z	3437c1e	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Nice work!

Reviewed commit: 3437c1e0f8

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".