Documentation
¶
Overview ¶
Command gitleaks-port translates the gitleaks default rule catalog (config/gitleaks.toml from the gitleaks repo) into Go SecretPattern entries for ox's session.RawWriter chokepoint.
Run via `make sync-gitleaks-rules`. The generator reads the pinned TOML alongside this file and writes internal/session/gitleaks_generated.go.
Why generate instead of import the gitleaks Go module: the gitleaks runtime pulls in a wazero WASM dependency and other heavy transitive imports. The rules themselves are static MIT-licensed data; the most honest dependency-minimal path is to translate them at build time and ship the generated Go file in the repo. The generator pin is updated by re-running `make sync-gitleaks-rules` with a newer toml.
Skipped at translation time:
- Rules whose regex doesn't compile with Go's regexp/RE2 (rare; gitleaks targets the same engine but a handful of patterns use features RE2 rejects).
- Rules duplicated by ox's existing DefaultPatterns or hand-ported DefaultExtraDetectors. Hand-ported wins because the ox version carries class-specific [REDACTED_*] slugs that consumers grep for.
- Rules that capture broad classes of content with no clear credential boundary (e.g. "generic-api-key" with very loose regex — those produce too many false positives in coding-agent session content, where keys, ids, and tokens of all shapes show up in legitimate prose).
Source Files