From f4e3ae6e683ed4c23a25eb1526d657b566a95a46 Mon Sep 17 00:00:00 2001
From: Alexandre Teixeira <111787685+alteixeira20@users.noreply.github.com>
Date: Wed, 28 Oct 2026 19:52:10 +0000
Subject: [PATCH] test(security): allowlist synthetic dummy api key in trace
 sanitizer test fixture

- Add gitleaks allowlist rule for synthetic test string in tests/test_trace_artifact_sanitizer.py
- Resolves Gitleaks generic-api-key false positive on GitHub Actions CI
---
 .gitleaks.toml | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/.gitleaks.toml b/.gitleaks.toml
index 0eec3f1ae..8543c9666 100644
--- a/.gitleaks.toml
+++ b/.gitleaks.toml
@@ -35,3 +35,15 @@ regexTarget = "secret"
 regexes = [
   '''^7abc5b334a6c3c52dd3eba15d8bc516da728a67f14fb7f56d0bb5992d89a16ca$''',
 ]
+
+[[allowlists]]
+description = "Synthetic dummy API key in trace artifact sanitizer test fixture"
+targetRules = ["generic-api-key"]
+condition = "AND"
+paths = [
+  '''(?:^|/)tests/test_trace_artifact_sanitizer\.py$''',
+]
+regexTarget = "secret"
+regexes = [
+  '''^sk-123456789$''',
+]