sec(gitleaks): commit-independent allowlists for permanent fixtures (backend#1404) — baseline retired

[LukasWodka]

Three-part change:

1. Adds a repo-root .gitleaks.toml with one commit-independent allowlist block: synthetic idempotency key in submit tests — 1 baseline entry (the baseline's only entry).
2. Deletes .gitleaks-baseline.json — its single entry is the test fixture the toml now covers.
3. Removes the gitleaks-baseline: .gitleaks-baseline.json input line from .github/workflows/code-quality-caller.yml (and only that line).

Why retire the baseline: its only entry was pinned to commit + file + line, so a future reformat of that line would have un-suppressed it — the exact defect backend#1404 names. The path+regex allowlist covers the fixture commit-independently, so it survives reformatting.

gitleaks 8.30.1 auto-loads the repo-root .gitleaks.toml, so no workflow change is needed to activate it — the caller edit here only removes the now-redundant baseline input. [extend] useDefault = true is present, so the default ruleset stays fully armed.

Part of tracebloc/backend#1404

🤖 Generated with Claude Code

---

Note

Low Risk
CI secret-scan configuration only; no application runtime, auth, or data-path changes.

Overview
Gitleaks no longer uses a baseline file for the single known false positive in submit tests. A new .gitleaks.toml allowlists the synthetic IdempotencyKey fixture in *_test.go via path + line regex, so suppressions survive line moves and reformats instead of being tied to commit/file/line.

.gitleaks-baseline.json is removed, and code-quality-caller.yml drops the gitleaks-baseline input only; gitleaks still loads the default ruleset via [extend] useDefault = true.

^{Reviewed by Cursor Bugbot for commit a60cce1. Bugbot is set up for automated code reviews on this repo. Configure here.}

[LukasWodka]

FR on staging → Ready for prod (staging FR sweep, 2026-08-06). Basis: CI/tooling-only change with no product runtime surface — verified green through code review + Bugbot on develop and the fr-gated staging promotion. No product-behavior verification required for this class.