ci(gitleaks): allowlist historical false-positive commits from rewrite graft

[harshitsinghbhandari]

Problem

The gitleaks job fails on every push to main and will keep failing indefinitely.

gitleaks-action@v1.6.0 (gitleaks v7.4.0) scans differently per event:

# push  → no commit filter, scans ENTIRE git history
gitleaks --path=$GITHUB_WORKSPACE --verbose --redact
# pull_request → only the PR's own commits
gitleaks ... --commits-file=commit_list.txt

The ReverbCode rewrite graft (#2166) brought 279 commits of prior history. 10 of them trip 42 findings, all false positives:

• Example secret-patterns in security docs (SECURITY.md, docs/DEVELOPMENT.md, docs/SECURITY-AUDIT-SUMMARY.md) describing what tokens look like (xoxb-*, -----BEGIN ... PRIVATE KEY-----, etc.).
• Secret-redaction test fixtures in packages/core/src/activity-events.ts + tests (secret-shaped strings used to assert the sanitizer strips them).

All offending files are already deleted from the tree. That's why PRs are green (they only scan their own diff) while pushes to main re-scan full history and fail.

Fix

Add .github/.gitleaks.toml (the path gitleaks-action already points --config-path at) containing the full gitleaks v7.4.0 default ruleset plus a commits allowlist for the 10 historical commits. The default rules must be included verbatim because gitleaks v7 replaces its built-in config when a config file is supplied; detection on new code is otherwise unchanged.

Allowlisting by commit SHA is precise and forward-safe: the offending files are gone, so no new code is exempted.

Verification

Ran the exact CI binary (gitleaks v7.4.0) over full history:

	result	exit
without config	leaks found: 42	1
with this config	No leaks found	0

🤖 Generated with Claude Code