From 181e069fe02aa4f12a6a6e0768607a1c3ccafabf Mon Sep 17 00:00:00 2001
From: anklemPT <anklem@gmail.com>
Date: Wed, 29 Jul 2026 05:55:03 +0100
Subject: [PATCH] =?UTF-8?q?sec(orga=20cont+29=20S3SCOOP):=20R-K5=20FP=20fi?=
 =?UTF-8?q?x=20Option=20A=20=E2=80=94=20allowlist=20GitHub=20Action=20SHA?=
 =?UTF-8?q?=20pins?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Per Iskra S226 Q1 «accept некоторые FPs» — same fix as portal PR#91 + agile-sapiens PR#212 + landing PR#14.

Refs:
- Iskra R-K5 SVOD Q1: Drive 15BP6q-_FVXooIAzIZqg2_oHINxQkPrmMAASvoirISYo

Session: S3SCOOP cont+29 extended
---
 .gitleaks.toml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.gitleaks.toml b/.gitleaks.toml
index 8a9b665..d41b87f 100644
--- a/.gitleaks.toml
+++ b/.gitleaks.toml
@@ -107,6 +107,10 @@ regexes = [
   '''YOUR[-_]?TOKEN[-_]?HERE''',
   '''\$\{[A-Z_]+_TOKEN\}''',
   '''<[a-zA-Z_-]+_TOKEN>''',
+  # GitHub Action SHA pins (Renovate/Dependabot pin actions к 40-char commit SHA)
+  # Per Iskra S226 Q1 «accept некоторые FPs» philosophy: filter known FP class
+  '''-action@[a-f0-9]{40}''',
+  '''actions/[a-z0-9-]+@[a-f0-9]{40}''',
 ]
 
 commits = []