.security-config.toml

# Security Scanning Configuration
# This file helps security scanners avoid false positives in our Ansible project

[security-exclusions]
# Comment decorations that look like secrets but aren't
exclude_patterns = [
    "^#.*=+.*$",  # Comment lines with equals decorations
    "^\\s*#.*=+.*$",  # Indented comment lines with equals
    "========================================",  # YAML comment decorations
    "# ========================================",  # YAML comment lines
]

# Files that contain test/example data and should be scanned differently
test_files = [
    "**/test*.yml",
    "**/test*.yaml", 
    "**/validation/**",
    "**/docs/research/**",
    "**/*test*",
    "**/*example*"
]

# AWS False Positive Exclusions
[aws-exclusions]
# These patterns in validation files are NOT AWS secret access keys
false_positives = [
    "========================================",
    "# ========================================"
]

# Project context
[project]
type = "ansible"
framework = "ansible-collection"
ignore_validation_files = true

# Known false positive patterns specific to this project
ansible_false_positives = [
    "# =============================================================================",
    "========================================",
    "# Test configuration",
    "# Experimental",
]

[scan-context]
project_type = "ansible-collection"
framework = "infrastructure-automation"
exclude_directories = [
    ".git",
    "node_modules", 
    "venv",
    ".venv",
    "__pycache__",
    ".pytest_cache"
]