Align GitLab token regexes with TruffleHog and add source provenance

[Copilot]

Custom pipeleek GitLab token regexes diverged from TruffleHog's patterns and lacked source attribution. This aligns them and documents each regex's origin.

Changes

• glpat v3: Use exact TruffleHog regex including \b word boundaries, pinned to commit afd5336:

  // https://github.com/trufflesecurity/trufflehog/blob/afd5336caad0f61da51750ffe39869974b27b0db/pkg/detectors/gitlab/v3/gitlab_v3.go#L34
  Regex: `\b(glpat-[a-zA-Z0-9\-=_]{27,300}.[0-9a-z]{2}.[a-z0-9]{9})\b`

• glpat v2: Split from single glpat- rule into separate v2/v3 rules matching TruffleHog's detector versioning ({20,22} vs {27,300} with routable token suffix)
• Character class: Aligned to [a-zA-Z0-9\-=_] across all token rules (added =)
• Added glrtr-: Runner Registration Token prefix was missing (REGISTRATION_RUNNER_TOKEN_PREFIX)
• Fixed naming: glrt- → "Runner Authentication Token" (not "Registration"), GR1348941 → "Runner Token (Legacy)"
• Source URLs: Every regex now has a comment linking to its origin — TruffleHog source, GitLab source model, or GitLab docs

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• gitlab.com
  • Triggering command: /tmp/go-build2004454262/b001/engine.test /tmp/go-build2004454262/b001/engine.test -test.paniconexit0 -test.timeout=10m0s -test.v=true -test.count=1 -test.run=GitLab 742219/b094/vet.-ifaceassert ux-amd64/pkg/tool/linux_amd64/vet -p github.com/truff-atomic t ux-amd64/pkg/too-buildtags (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

---

This section details on the original issue you should resolve

<issue_title>glpat detection</issue_title>
<issue_description>If the trufflehog verification of the gitlab scan command is active and a glpat is found its always verified againts gitlab.com. This suppresses glpat findings in case of self hosted gitlab instances.

If possible it should be verified against the gitlab instance configured in pipeleek. If this is not possible we should always report glpats e.g. by adding a builtin rule for all types of the gitlab tokens.</issue_description>

Comments on the Issue (you are @copilot in this section)

• Fixes glpat detection #565

---

📍 Connect Copilot coding agent with Jira, Azure Boards or Linear to delegate work to Copilot in one click without leaving your project management tool.

[Copilot]

Pull request overview

This PR extends Pipeleek’s built-in scanner rules with regex-based detectors for multiple GitLab token formats so tokens are still detected even when TruffleHog verification suppresses unverified GitLab findings (notably for self-hosted GitLab instances).

Changes:

• Added built-in regex rules for a range of GitLab token types (PAT v2/v3, runner tokens, deploy/build tokens, etc.).
• Updated existing rules tests to account for the new built-in rules and added assertions that the new rules exist and are marked high confidence.
• Added an engine-level test intended to validate detection behavior when TruffleHog verification is enabled.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
pkg/scanner/rules/rules.go	Appends new built-in GitLab token regex rules to the secrets patterns list.
pkg/scanner/rules/rules_test.go	Updates rule-count expectations and adds a test ensuring all GitLab token rules exist with high confidence.
pkg/scanner/engine/engine_test.go	Adds a detection test for GitLab tokens while TruffleHog verification is enabled.