ci(gitleaks): gate PRs on their own commits, pin two more false positives

[ralyodio]

Every PR in this repo fails gitleaks, whatever it touches — #163 (an /ads feature) and #166 (the env-backup removal) both went red on a finding neither introduced.

Cause

The job runs gitleaks detect --source . with fetch-depth: 0, i.e. full history, on every PR. History does not change when a PR changes, so the same blob is reported forever. A check that is red on arrival is a check nobody reads — which is the failure mode that actually matters for a secret scanner.

Change

PRs scan base..head only. History is still scanned in full on push to master and on the existing weekly cron, so an existing finding cannot be merged out of sight — it just stops masking new ones.

Two more false-positive fingerprints. A fingerprint pins one commit, and both lines already in .gitleaksignore survived later edits to their files, so each matches again under a newer SHA:

• 2eb14f9b — the pk_test_… publishable key in the sample <script> fixture the analyzer test asserts on
• 508859ed — the docs curl example, by then reading -H "Authorization: Bearer $SECRET", a shell variable

Deliberately NOT suppressed

The 21 findings in .env.bak-2026-07-28 (commit 925da5e2) — a private key, a GCP API key and 19 API keys. Those are real credentials, still in history. Pinning them before they are rotated would hide a live exposure. The full-history scan stays red on them until they are rotated and the blob is purged, which is correct.

Verification

Run locally with gitleaks 8.21.2, the same version CI installs:

• Full-history scan: 23 → 21 findings; the 2 non-env findings are gone, all 21 left are the real .env.bak credentials.
• PR-mode scan of this branch: 1 commits scanned … no leaks found, exit 0.
• The gate still blocks new secrets — planted a private key in a temp commit, PR-mode scan reported leaks found: 1, exit 1. (First attempt used AKIAIOSFODNN7EXAMPLE, which gitleaks allowlists as AWS's own documentation key, so it correctly did not fire.)

🤖 Generated with Claude Code

[github-actions]

vu1nz Security Review

0 finding(s) in PR #?

No security issues found.