.gitleaksignore

# Gitleaks false-positive fingerprints
#
# These are findings that are NOT real secrets — they are test-only credentials,
# placeholder values, or CI constructs that gitleaks cannot distinguish from
# real credentials with its regex engine.
#
# See .gitleaks.toml [allowlist] for pattern-based exceptions used for common cases.
# This file handles specific line-by-line false positives.

# mt#2369 cold-start CI workflow: DATABASE_URL composed via GitHub Actions
# format() expression so no literal URL is embedded. The credentials are
# test-only ephemeral values scoped to the job's ephemeral postgres container.
# Gitleaks matches the format-string template as a false positive.
# (Line shifted 54→58 by the mt#2439 bootstrap-step additions.)
.github/workflows/cold-start-migrate.yml:database-url-credentials:58

# mt#1428: same workflow, same format() construct — MINSKY_POSTGRES_URL is the
# config-loader-visible copy of the same test-only ephemeral DSN (the loader
# does not read DATABASE_URL). Step-scoped on the smoke step.
.github/workflows/cold-start-migrate.yml:database-url-credentials:114

# mt#3349 integration-tests workflow, `postgres-service` job: identical
# format()-composed construct to the cold-start entries above — no literal URL
# is embedded, and the credentials are test-only values scoped to the job's
# ephemeral pgvector service container, unreachable from outside it.
# Line 248 is the job-level INTEGRATION_POSTGRES_URL the test reads; line 276 is
# the step-scoped MINSKY_POSTGRES_URL the config loader reads for `persistence
# migrate` (the loader does not read the former). Same two-copies-of-one-DSN
# reason as mt#1428 above.
.github/workflows/integration-tests.yml:database-url-credentials:248
.github/workflows/integration-tests.yml:database-url-credentials:276

# mt#3887 npm-pack-install-smoke workflow: same format()-composed construct as
# the cold-start-migrate entries above — no literal URL is embedded, and the
# credentials are test-only values scoped to the job's ephemeral pgvector
# service container, unreachable from outside it. Enables step 4b's migration
# falsifier (the meta/*_snapshot.json exclusion premise) against a real
# Postgres in CI.
.github/workflows/npm-pack-install-smoke.yml:database-url-credentials:106