fix(ci): update gitleaks config (#2744)

Signed-off-by: Sylwester Piskozub <sylwesterpiskozub@gmail.com>

Author: Piskoo

.github/workflows/utils/.gitleaks.toml

@@ -3,9 +3,13 @@ title = "Gitleaks config"
 [extend]
 useDefault = true
 
-# Ignore test files and test directories
 [[allowlists]]
 paths = [
   '''.*_test\..*''',                    # Test files
   '''(^|/)testdata/.*''',               # Testdata directories
+  '''devel/devkeys/.*''',               # Development keys
+  '''devel/README\.md''',               # Development docs with example tokens
+  '''deployment/chainloop/.*README\.md''',  # Helm chart documentation
+  '''deployment/chainloop/values\.yaml''',  # Helm values with example keys
+  '''deployment/chainloop/templates/_helpers\.tpl''',  # Helm template helpers
 ]

.gitleaksignore

@@ -415,7 +415,7 @@ var (
 	// It can be overridden by the user if they want to use their own instance of Posthog or deactivated by setting
 	// DO_NOT_TRACK=1 more information that can be found at: https://github.com/chainloop-dev/chainloop/blob/main/docs/docs/reference/operator/cli-telemetry.mdx
 	// nolint:gosec
-	posthogAPIKey   = "phc_TWWW19kEiD6sEejlHKWcICQ5Vc06vZUTYia8WdPB0A0"
+	posthogAPIKey   = "phc_TWWW19kEiD6sEejlHKWcICQ5Vc06vZUTYia8WdPB0A0" // gitleaks:allow
 	posthogEndpoint = "https://crb.chainloop.dev"
 )
 

app/cli/cmd/root.go

@@ -132,6 +132,6 @@ modules:
         - FIELD_SAME_DEFAULT
 deps:
   - buf.build/bufbuild/protovalidate:v1.1.0
-  - buf.build/googleapis/googleapis:4ed3bc159a8b4ac68fe253218760d035
+  - buf.build/googleapis/googleapis:4ed3bc159a8b4ac68fe253218760d035 # gitleaks:allow
   - buf.build/grpc-ecosystem/grpc-gateway:v2.26.3
   - buf.build/kratos-go/kratos:e1d52e944e3845c6862a566db322432d