Build realistic test fakes at run time; add narrow secret-scan configs

.gitattributes

@@ -13,6 +13,8 @@
 .editorconfig         export-ignore
 .gitattributes        export-ignore
 .gitignore            export-ignore
+.gitguardian.yaml     export-ignore
+.gitleaks.toml        export-ignore
 .mcp.json             export-ignore
 benchmark.php         export-ignore
 CHANGELOG.md          export-ignore

.gitguardian.yaml

@@ -0,0 +1,13 @@
+# Secret-scan policy. Written by agent-kit's secret_scan.py; extend it by hand, narrowly.
+#
+# ggshield reads this file (pre-commit, CI, local scans). The GitGuardian GitHub App, which posts
+# the "GitGuardian Security Checks" run on pull requests, does not: its exclusions live in the
+# GitGuardian dashboard (Settings -> Secrets detection -> Exclusion rules).
+#
+# Only named fixture and example-env paths are ignored. Never src/, never a real .env, never a
+# detector. secret_scan.py still searches these paths for live-format keys. If a finding is real,
+# rotate it first and then remove it; never add it here.
+version: 2
+secret:
+  ignored_paths:
+    - "tests/Fixtures/**/*"

.gitleaks.toml

@@ -0,0 +1,12 @@
+# gitleaks policy. Written by agent-kit's secret_scan.py; extend it by hand, narrowly.
+# Only named fixture and example-env paths are allowlisted; secret_scan.py still
+# searches them for live-format keys. A realistic fake elsewhere carries an inline
+# `gitleaks:allow` comment instead.
+[extend]
+useDefault = true
+
+[[allowlists]]
+description = "Named fixture and example-env paths (agent-kit secret_scan.py)"
+paths = [
+  '''^tests/Fixtures/(?:.*/)?[^/]*$''',
+]

tests/Rules/Crypto/CryptoRulesTest.php

@@ -38,7 +38,7 @@
 })->with([
     'truncated'            => '1A1zP1eP5QGefi2DMPTfTL5SLmv7Divf',
     'chars outside base58' => '0OIl1A1zP1eP5QGefi2DMPTfTL5SLmv7',
-    'mixed-case bech32'    => 'bc1Qw508d6qejxtdg4y5r3zarvary0c5xw7kv8f3t4',
+    'mixed-case bech32'    => str_replace('bc1q', 'bc1Q', 'bc1qw508d6qejxtdg4y5r3zarvary0c5xw7kv8f3t4'),
     'wrong hrp'            => 'ltc1qw508d6qejxtdg4y5r3zarvary0c5xw7kv8f3t4',
     'not an address'       => 'not-an-address',
     'ethereum address'     => '0x52908400098527886E0F7030069857D2E4169EE7',

tests/Rules/TrailingNewlineTest.php

@@ -23,6 +23,17 @@
 use Simtabi\Laranail\Validation\Rules\Numbers\MonetaryAmount;
 use Simtabi\Laranail\Validation\Rules\Fiscal\NationalIdentifier;
 
+/**
+ * A structurally valid JWT, assembled at run time rather than committed whole, so a
+ * secret scanner does not read the fixture as a leaked token.
+ */
+function trailingNewlineJwt(): string
+{
+    $segment = static fn (array $claims): string => rtrim(strtr(base64_encode((string) json_encode($claims)), '+/', '-_'), '=');
+
+    return $segment(['alg' => 'HS256', 'typ' => 'JWT']) . '.' . $segment(['sub' => '1']) . '.c2ln';
+}
+
 /**
  * The trailing-newline sweep: every anchored single-line pattern in the rule
  * library must carry the `D` modifier (or `\z`), because a bare `$` in PCRE
@@ -41,7 +52,7 @@
         ->and(ruleAccepts($rule, $valid . "\n"))->toBeFalse();
 })->with([
     'Slug'              => [fn (): object => new Slug, 'my-slug'],
-    'Jwt'               => [fn (): object => new Jwt, 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxIn0.c2ln'],
+    'Jwt'               => [fn (): object => new Jwt, trailingNewlineJwt()],
     'DomainName'        => [fn (): object => new DomainName, 'example.com'],
     'PersonName'        => [fn (): object => new PersonName, 'Ada Lovelace'],
     'EthereumAddress'   => [fn (): object => new EthereumAddress, '0xabcdefabcdefabcdefabcdefabcdefabcdefabcd'],