From 60283938b2ab2b7281fa8a4bd57f88930354f21f Mon Sep 17 00:00:00 2001
From: Kendrik Felty <kcsfelty+github@gmail.com>
Date: Fri, 24 Jul 2026 18:04:34 -0500
Subject: [PATCH] ci: scope bootstrap migration allowlist

---
 .gitleaks.toml | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/.gitleaks.toml b/.gitleaks.toml
index 57e9d79..db12790 100644
--- a/.gitleaks.toml
+++ b/.gitleaks.toml
@@ -9,3 +9,11 @@ condition = "AND"
 regexTarget = "secret"
 regexes = ['''^item-subject-v1$''']
 paths = ['''(^|/)test/search\.integration\.test\.ts$''']
+
+[[allowlists]]
+description = "Known non-secret bootstrap migration identifier"
+condition = "AND"
+targetRules = ["generic-api-key"]
+regexTarget = "match"
+regexes = ['''^0008_bootstrap_credentials',\r?\n\s*'0009_operation_receipts'$''']
+paths = ['''(^|/)scripts/prepare-candidate\.mjs$''']