[extend]
useDefault = true

# These files contain published SHA-256 provenance values. Gitleaks' generic
# key rule mistakes the JSON field names for credentials; the values are
# one-way digests, not authentication material. Keep the allowlist path-bound.
[[allowlists]]
description = "Published provenance SHA-256 values"
paths = [
  '''^manifests/runtime/phase-0\.9e-r-release-correlation\.json$''',
  '''^manifests/retroarch/phase-1\.0bz-exact-sdl-stage-cleanup-gate\.json$''',
  '''^manifests/retroarch/phase-1\.0ca-cleanup-result-and-hash-verifier-correction-gate\.json$'''
]