[Tiancheng-Xu]

Summary

Adds the focused built-in TOML filter for gitleaks in dir and git modes.

• New filter: src/filters/gitleaks.toml
  • Match pattern: ^gitleaks\s+(dir|git)\b
  • Removes banner and divider noise
  • Keeps required findings fields (Finding, RuleID, Secret, Entropy, File, Line, Commit, Author, Fingerprint)
  • Keeps final summary lines (No secrets found, Found/\d+ leaks|findings)
  • Includes representative inline fixtures for gitleaks dir and gitleaks git + a no-secrets case
• Built-in TOML registration updates in src/core/toml_filter.rs
  • Add gitleaks to the expected built-in filter list
  • Increment expected built-in filter count to 64

Scope / constraints

• Per issue feat: add gitleaks filter/command for secret-scan output #3921 scope, only the TOML-filter portion is implemented.
• Rust subcommand support was intentionally omitted unless TOML filtering proves insufficient.

Validation status

I was not able to run Rust validation in this environment because cargo/rtk tooling is not installed locally.

Please run locally before merge:

• cargo fmt --all --check
• cargo test
• cargo clippy --all-targets
• rtk verify (or cargo run -- verify) and/or PR CI

Also requested, please execute a repo secret/PII scan in your normal environment.

Closes #3921

[CLAassistant]

All committers have signed the CLA.

[Copilot]

🟡 Changes recommended

The new gitleaks fixtures are internally inconsistent and the on_empty message can misleadingly report a “clean” result when no lines match.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Adds first-class TOML filtering support for gitleaks output so RTK can compact gitleaks dir / gitleaks git findings into a smaller, consistent set of key fields and summary lines.

Changes:

• Added a new built-in TOML filter gitleaks.toml with inline fixtures for dir, git, and “no secrets” output.
• Registered gitleaks in the built-in TOML filter registry expectations and bumped the built-in filter count to 64.

File summaries

File	Description
src/filters/gitleaks.toml	New TOML filter definition and inline test fixtures for compacting gitleaks output.
src/core/toml_filter.rs	Adds gitleaks to the expected built-in filter names list and updates the expected built-in filter count.

Review details

Suppressed comments (1)

src/filters/gitleaks.toml:79

• The expected output also ends with 0 leaks found despite two findings in the fixture input; updating it keeps the test coherent.

File: server/.env
Line: 8
Fingerprint: c3b4a8a1d0e7f7c2d5f6d8a9b2f3c4d5e6f70809a:server/.env:stripe-access-token:8
0 leaks found"""

• Files reviewed: 2/2 changed files
• Comments generated: 2
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Tiancheng-Xu]

Addressed in e4a487d. Removed the unconditional on_empty clean fallback, and added preservation plus an inline regression fixture for common gitleaks diagnostics such as ERRO[...], so an error cannot be reported as clean.

[Tiancheng-Xu]

Addressed in e4a487d. The dir fixture now reports 2 leaks found in both the input and expected output, matching the two findings included in the fixture.

[Tiancheng-Xu]

Re-checked the requested changes on commit e4a487d: the unconditional on_empty fallback is removed, an ERRO[...] diagnostic fixture is preserved, and the dir fixture consistently reports 2 leaks found. git diff --check passes locally; Rust tests could not run because cargo is unavailable in this environment.