# Trivy secret-scan config (read by `trivy fs` from the repo root by default).
#
# agent-runtime/src/memory.rs tests that a token-shaped string is refused as a
# memory entry, so it holds fake `ghp_…` values on purpose. Allow only that file;
# every other path is still scanned for github-pat and all other rules.
allow-rules:
  - id: memory-redaction-test-fixtures
    description: Fake ghp_ tokens in the memory redaction tests (agent-runtime/src/memory.rs)
    path: ^agent-runtime/src/memory\.rs$