Answer

I reproduced the failure with real gitleaks (v8.30.1) in /tmp/repro, applied the fix, and verified it — including a negative control and a proof that per-line gitleaks:allow is not durable across history. Solution written to ~/SOLUTION.md.

Fix: scrubber test fixtures trip gitleaks generic-api-key

Symptom

A redactor's own tests embed credential-shaped strings to prove redaction. gitleaks flags exactly those files:

RuleID:      generic-api-key
File:        internal/journal/scrub_test.go
Line:        11

The tier-2 judge reads a false leak.

Root cause

• gitleaks default rules are pattern + entropy based; they can't know a value is a fixture. Redaction tests will always look like leaks.
• //gitleaks:allow only suppresses the current working tree. The historical commit that introduced the fixture lacks the comment, so full-history gitleaks detect still trips.
• Durable fix = repo config allowlisting only the redactor test files.

The fix — .gitleaks.toml at repo root

# .gitleaks.toml
[extend]
useDefault = true

# Redactor tests intentionally embed credential-shaped fixtures.
# Allowlist ONLY these two files; real leaks elsewhere still count.
[[allowlists]]
description = "Redactor test fixtures"
paths = [
  '''^internal/journal/(journal|scrub)_test\.go$''',
]

• Anchored regex only — never a directory or broad .*_test\.go$.
• gitleaks auto-loads <target>/.gitleaks.toml, so both detect and protect pick it up.
• Older gitleaks (< v8.19) uses singular [allowlist] with the same paths.
• Keep per-line //gitleaks:allow next to fixtures for intent, but the config is what clears history.

Verification (all run, real output)

1. Reproduce without config: gitleaks detect -v → 3 findings in journal_test.go / scrub_test.go.
2. Full-history with config: gitleaks detect -v → no leaks found, exit 0. Also --no-git → 0.
3. Negative control: added a genuine secret in internal/api/client.go → still RuleID: generic-api-key, leaks found: 1. Allowlist is narrow.
4. Per-line is not enough: commit A fixture (no comment) + commit B //gitleaks:allow → history scan still leaks found: 1, exit 1. Adding the path-allowlist config → no leaks found, exit 0.

CI

- name: gitleaks
  run: gitleaks detect --config .gitleaks.toml --redact --no-banner

Full self-contained write-up (root cause, exact fix, commands, expected outputs, acceptance criteria) is in ~/SOLUTION.md.