# Known-benign places for tools/scan-secrets.sh
#
# Format, one entry per line:
#   path-glob|line-substring|reason
#
# An entry says: this is a placeholder, a marker, a test fixture or
# documentation, and a human has read the line. The path glob and the line
# substring are both matched case-insensitively, because names in code are upper
# case while the prose around them is not. The substring may be empty, which
# allowlists every hit in that file -- do that only for a file that documents
# secret shapes on purpose.
#
# Rules for adding an entry
#   1. Run the scanner with --show-values and read the line. Never allowlist
#      something you have not read.
#   2. Prefer fixing the code over allowlisting it. An entry is a decision that
#      this shape will keep appearing, not a way to silence a warning.
#   3. Keep the substring as specific as possible, so a real secret on a
#      neighbouring line is still reported.
#   4. Re-run `tools/scan-secrets.sh --strict` afterwards: it must exit 0.
#
# This file itself is never scanned: it quotes the shapes it documents, which
# would otherwise be reported as findings in the allowlist.

# --- internal markers and variable plumbing, not values ----------------------
# The manager passes this literal through argv in place of the licence; the real
# value is read from a temporary file by the child shell. Seeing the marker in a
# command line is the design working, not a leak.
bash_wp-cli_update.sh|@@wp_cli_update_licence@@|internal placeholder that travels through argv instead of the licence value
bash_wp-cli_update.sh|"$licence_marker"|reference to the internal placeholder constant
bash_wp-cli_update.sh|licence_value=|the option value is stored in a variable, no literal here
bash_wp-cli_update.sh|licence_file="$(mktemp|path of the temporary handoff file, not a value
bash_wp-cli_update.sh|astra_key=|documentation of the --astra-key option in the help text
bash_wp-cli_update.sh|astra_slug=|plugin slug from the command line, not a credential

# --- test fixtures ----------------------------------------------------------
# These values are invented for the test run and are never sent anywhere. They
# exist so the suite can assert that a secret does NOT appear in a log or in argv.
tests/test_manager.sh|sup3r-secret-licence-value-0001|invented test secret used to prove the value never reaches argv or a log
tests/test_manager.sh|astra_fail_slug=astra-addon|test hook name for the stub wp, not a credential
tests/test_manager.sh|licence=<set,len=|assertion on the masked licence state reported by the stub
tests/test_finder.sh|astra|option name inside a documentation assertion
tests/test_base_contract.sh|astra|option name inside a documentation assertion
tests/test_secretguard.sh||the guard test plants invented values on purpose and cleans them up
tests/stub/wp|licence=|the stub reports only the length and a checksum, never the value

# --- documentation and templates --------------------------------------------
*.md|example|documentation example
*.md|your_|documentation placeholder
*.conf.example||template that ships with placeholders on purpose