title = "Gitleaks configuration for wpcom-i18n"

[extend]
useDefault = true

# Repo is ~99% translation catalogues (JED JSON + gettext po/mo/pot);
# default ruleset backtracks on multi-MB locale files and times out.
#
# The allowlist is scoped to catalogue-shaped filenames only:
#   - gettext files (*.po, *.mo, *.pot)
#   - build-hash catalogues:   <name>-<32-hex>.json (e.g. plugins/jetpack-de-<md5>.json)
#   - locale-named catalogues: <locale>.json / <locale>-v1.1.json (e.g. zh-tw.json)
#   - continents-cities locale data
# Any other file — config JSON, scripts, docs — is still scanned.
[[allowlists]]
description = "Translation catalogues — locale data, not credentials"
paths = [
  '''\.po$''',
  '''\.mo$''',
  '''\.pot$''',
  '''-[0-9a-f]{32}\.json$''',
  '''(^|/)[a-zA-Z]{2,3}([_-][a-zA-Z]{2,10}){0,2}(-v1\.1)?\.json$''',
  '''(^|/)continents-cities(-[a-zA-Z_]+)?\.json$''',
]