ci(gitleaks): allowlist the response-filter fixture secrets

[scttbnsn]

The dev/v2.1 CI Verify run on 803888c failed only on Gitleaks: three generic-api-key hits, all in the test fixtures #482 added. Two are the base64 podman-secret payload the partial-decode differential uses to prove redaction still reaches SecretData, one is the s3cr3t-signing-key env value in the inspect benchmark body.

Both values are synthetic. This adds them to .gitleaks.toml the same way the swarm and seccomp fixtures are already handled: value and path both have to match, so the same strings anywhere else still fail the scan.

Verified locally with gitleaks detect --log-opts=origin/main..HEAD: no leaks found.

✨ Added Gitleaks allowlist entries for synthetic secrets in response-filter test fixtures.

🔒 Scoped each allowlist entry to its exact fixture path with condition = "AND":

• podman-secret base64 payloads in app/internal/responsefilter/list_item_partial_decode_test.go

• s3cr3t-signing-key in app/internal/responsefilter/perf_bench_test.go

• Verify that both podman-secret payloads are explicitly allowlisted.

• Confirm gitleaks detect --log-opts=origin/main..HEAD passes.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
sockguard-website	Ready	Preview	Sep 6, 2026 12:12pm UTC

[biggest-littlest]

Reviewed against the CHANGELOG entry and the diff; CI green outside the qlty/Vercel quota noise.

[ALARGECOMPANY]

Reviewed against the CHANGELOG entry and the diff; CI green outside the qlty/Vercel quota noise.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Team

Run ID: 9e17d8ec-3c33-477c-9cde-a94a9d8a9331

📥 Commits

Reviewing files that changed from the base of the PR and between 803888c and 89db91c.

⛔ Files ignored due to path filters (1)

• CHANGELOG.md is excluded by !CHANGELOG.md

📒 Files selected for processing (1)

• .gitleaks.toml

---

📝 Walkthrough

Walkthrough

Added two gitleaks allowlist entries in .gitleaks.toml. Each entry uses condition = "AND" and limits the exception to one test file. The entries cover a synthetic base64 payload and a synthetic signing key.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch ci/gitleaks-allow-responsefilter-fixtures

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}