fix: align Wave 3 security gates with tools template

Use pinned gitleaks CLI, flatten allowlist TOML, and harden
the allowlist expiry parser. Point JS CodeQL at the split pack.

Signed-off-by: Nathan Gillett <nathan@intentproof.io>

Author: Nathan Gillett

.github/workflows/codeql.yml

@@ -31,11 +31,15 @@ jobs:
         with:
           fetch-depth: 0
 
+      - name: Install gitleaks
+        run: |
+          curl -sSfL \
+            "https://github.com/gitleaks/gitleaks/releases/download/v8.24.2/gitleaks_8.24.2_linux_x64.tar.gz" \
+            | tar -xz
+          sudo install -m 755 gitleaks /usr/local/bin/gitleaks
+
       - name: Run gitleaks
-        uses: gitleaks/gitleaks-action@v2
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          GITLEAKS_CONFIG: .gitleaks.toml
+        run: gitleaks detect --source . --config .gitleaks.toml --verbose --redact
 
   analyze:
     name: "IntentProof Security: CodeQL (${{ matrix.language }})"

.gitleaks.toml

@@ -8,13 +8,13 @@ useDefault = true
 
 [allowlist]
 description = "Global allowlist paths for false positives"
+regexTarget = "match"
 paths = [
   '''\.git/''',
   '''\.coverage''',
   '''tests/fixtures/''',
 ]
-
-[allowlist.regexTarget]
+# Example test vectors and documentation placeholders only.
 regexes = [
   '''EXAMPLE|PLACEHOLDER|REDACTED|xxxxxxxx''',
 ]

scripts/check-codeql-allowlist.sh

@@ -28,13 +28,17 @@ entries = []
 current = None
 for line in text.splitlines():
     stripped = line.strip()
-    if stripped.startswith("- ") and "rule_id:" in stripped:
+    if stripped.startswith("- "):
         if current:
             entries.append(current)
         current = {}
-        m = re.search(r"rule_id:\s*(\S+)", stripped)
+        item = stripped[2:].strip()
+        m = re.search(r"rule_id:\s*(\S+)", item)
         if m:
             current["rule_id"] = m.group(1)
+        m = re.search(r"expires:\s*(\S+)", item)
+        if m:
+            current["expires"] = m.group(1)
         continue
     if current is None:
         continue