From 9ef28eb6f6d8b0655b01e7454204c3aacdc66dab Mon Sep 17 00:00:00 2001
From: John Osumi <931193+sumitake@users.noreply.github.com>
Date: Sun, 9 Aug 2026 20:53:40 -0700
Subject: [PATCH] ci: allow reviewed historical gitleaks fixtures

---
 .gitleaksignore                               |  5 +++
 .../test_ci_portability_contract.py           | 32 ++++++++++++++++---
 2 files changed, 32 insertions(+), 5 deletions(-)

diff --git a/.gitleaksignore b/.gitleaksignore
index dc0b094..236e091 100644
--- a/.gitleaksignore
+++ b/.gitleaksignore
@@ -1 +1,6 @@
 cf2fef5c4c8a156f6303311b040428620a2bbc95:internal/hostruntime/operation_receipt_test.go:generic-api-key:13
+8075e44d05b02bcdd117e60f057d624b37a0dcab:internal/hostruntime/operation_receipt_test.go:generic-api-key:13
+cafa5cbaf5123c8e46028b535997f32e45db972e:tests/config/schema-validation.test.mjs:github-pat:89
+cafa5cbaf5123c8e46028b535997f32e45db972e:tests/sanitization/test_sanitize_public.py:generic-api-key:361
+cafa5cbaf5123c8e46028b535997f32e45db972e:tests/sanitization/test_sanitize_public.py:generic-api-key:580
+cafa5cbaf5123c8e46028b535997f32e45db972e:tests/sanitization/test_sanitize_public.py:generic-api-key:788
diff --git a/tests/repository/test_ci_portability_contract.py b/tests/repository/test_ci_portability_contract.py
index 8045ede..34caa04 100644
--- a/tests/repository/test_ci_portability_contract.py
+++ b/tests/repository/test_ci_portability_contract.py
@@ -9,9 +9,31 @@
 
 REPO_ROOT = Path(__file__).resolve().parents[2]
 
-GITLEAKS_FINGERPRINT = (
-    "cf2fef5c4c8a156f6303311b040428620a2bbc95:"
-    "internal/hostruntime/operation_receipt_test.go:generic-api-key:13"
+GITLEAKS_FINGERPRINTS = (
+    (
+        "cf2fef5c4c8a156f6303311b040428620a2bbc95:"
+        "internal/hostruntime/operation_receipt_test.go:generic-api-key:13"
+    ),
+    (
+        "8075e44d05b02bcdd117e60f057d624b37a0dcab:"
+        "internal/hostruntime/operation_receipt_test.go:generic-api-key:13"
+    ),
+    (
+        "cafa5cbaf5123c8e46028b535997f32e45db972e:"
+        "tests/config/schema-validation.test.mjs:github-pat:89"
+    ),
+    (
+        "cafa5cbaf5123c8e46028b535997f32e45db972e:"
+        "tests/sanitization/test_sanitize_public.py:generic-api-key:361"
+    ),
+    (
+        "cafa5cbaf5123c8e46028b535997f32e45db972e:"
+        "tests/sanitization/test_sanitize_public.py:generic-api-key:580"
+    ),
+    (
+        "cafa5cbaf5123c8e46028b535997f32e45db972e:"
+        "tests/sanitization/test_sanitize_public.py:generic-api-key:788"
+    ),
 )
 
 
@@ -65,12 +87,12 @@ def test_legacy_layout_matches_docker_full_line_sort(self) -> None:
             ),
         )
 
-    def test_gitleaks_exception_is_one_exact_historical_fingerprint(self) -> None:
+    def test_gitleaks_exceptions_are_exact_historical_fingerprints(self) -> None:
         ignore = REPO_ROOT / ".gitleaksignore"
         self.assertTrue(ignore.is_file())
         self.assertEqual(
             ignore.read_text(encoding="utf-8").splitlines(),
-            [GITLEAKS_FINGERPRINT],
+            list(GITLEAKS_FINGERPRINTS),
         )
         self.assertEqual(
             (REPO_ROOT / ".gitleaks.toml").read_text(encoding="utf-8"),