# Gitleaks fingerprint allowlist for known false positives.
#
# Fingerprint formats:
#   <file>:<rule-id>:<start-line>                   -- matched by `gitleaks protect` (pre-commit)
#   <commit-sha>:<file>:<rule-id>:<start-line>      -- matched by `gitleaks detect` (pre-push)
#
# The Databricks go/githooks pre-commit hook overrides --config (so a repo
# .gitleaks.toml is never read), but both hooks honor .gitleaksignore at the
# repo root via gitleaks v8's built-in fingerprint allowlist. Pre-push uses
# `detect` mode, which requires the commit-SHA-prefixed form.

# tiktoken-0.13.0 cp314-macosx wheel SHA-256 starts with "eaaa", which the
# square-access-token rule (anchored on EAAA...) misclassifies. The match
# is a content-addressed package hash, not a secret.
uv.lock:square-access-token:6189
696fd4bf191df78b669375cd8586dd779e3bc6b6:uv.lock:square-access-token:6189

# Commented-out example db connection string template in a config file
# (literal placeholder like ``user`` and ``password``, not a real
# credential). Introduced in the repo's initial commit; the config file
# was later moved to config/examples/05_memory/.
5c78b52d19d4bc63a6f7570e9ded40f551051033:config/examples/04_memory/postgres_persistence.yaml:postgres-connection-string:78

# Placeholder connection-string template inside a Mermaid diagram in the
# 05_memory README, illustrating the shape of the Unity Catalog secret
# contents. Not a real credential. Both SHAs below carry the same line
# (cherry-pick / rebase history).
5977040684e41baf377581bdf6104403f7e8d4ea:config/examples/05_memory/README.md:postgres-connection-string:154
5d33d1e95658694ec754b7cd660b71c6985961ed:config/examples/05_memory/README.md:postgres-connection-string:154

# Synthetic connection-string used as a test fixture in a context-aware
# cache test — literal `test:test@localhost/test`, not a real credential.
cd92208c887a72e2da3e5a4fb2a86137658fe3d5:tests/dao_ai/test_context_aware_cache.py:postgres-connection-string:720
