chore: ignore http-recorder test fixtures in GitGuardian scans

[Alezander9]

Summary

Add .gitguardian.yaml to suppress the recurring GitGuardian check failure on packages/http-recorder/test/record-replay.test.ts.

Background

PR #58's GitGuardian check failed on a "Google API Key" finding at packages/http-recorder/test/record-replay.test.ts:122 (AIzaSyDHibiBRvJZLsFnPYPoiTwxY4ztQ55yqCE). The "secret" is a test fixture: the file asserts that the http-recorder's secretFindings() function correctly detects and redacts Google-API-Key-shaped strings, which requires having a key-shaped string in the input.

The string comes from upstream commit 5bb7b2344 (anomalyco/opencode — the native LLM core PR adopted in #58). Upstream has its own .gitleaksignore listing the same lines, but gitleaks and GitGuardian are separate scanners with separate ignore files — and our org's GitHub check uses GitGuardian.

Why this is safe

• The fixtures are intentionally fake, asserting a redaction function works.
• @opencode-ai/http-recorder is upstream-only dev/test code. Not a dependency of browsercode-core, bcode-browser, or bcode-laminar — verified by grepping their package.json files.
• The package is outside our filtered typecheck scope.

Without this fix

Every future upstream sync will keep re-triggering this check (upstream isn't going to delete a test fixture), so each sync PR would have to be merged over a red GitGuardian check. This adds 14 lines of YAML and the noise goes away.

[cubic-dev-ai]

1 issue found across 1 file

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name=".gitguardian.yaml">

<violation number="1" location=".gitguardian.yaml:14">
P2: The ignore pattern is too broad for a secret-scanning exception. Scope this to the specific fixture file (or exact finding) so future real secrets in other test files are still detected.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review, or fix all with cubic.}