fix(security): suppress orch fixture via stopword, not SHA fingerprint (aws-samples#537) (aws-samples#538)

gitleaks regressed on main: aws-samples#530 baselined the orch_abc_SUB-1 test-fixture
false positive with a commit-SHA fingerprint in .gitleaksignore, and a later
history rewrite (dep-bump merges) changed that commit's SHA (f98f47a -> 73bfe08),
so the fingerprint no longer matched and the finding resurfaced — failing
security:secrets on main and blocking any PR (including aws-samples#532).

Replace the SHA-keyed fingerprint with a SHA-independent stopword allowlist in
.gitleaks.toml, matching the existing fixture-allowlist pattern
(wat-opaque-123, test-signing-secret-abc123). Survives history rewrites.

Verified: `mise run security:secrets` -> "no leaks found" (exit 0).

Fixes aws-samples#537

Co-authored-by: Mandeep Singh <mandeep408@users.noreply.github.com>
Co-authored-by: Claude <noreply@anthropic.com>

Author: mandeep408

.gitleaks.toml

@@ -19,6 +19,15 @@ stopwords = ["wat-opaque-123"]
 description = "Test fixture signing secret in Slack verification unit test (not a real credential)."
 stopwords = ["test-signing-secret-abc123"]
 
+[[allowlists]]
+# Test idempotency-key fixture in orchestration-release.test.ts (not a real
+# credential). Suppressed by stopword rather than a .gitleaksignore commit-SHA
+# fingerprint: the finding lives in history and SHA fingerprints break whenever
+# history is rewritten (rebases / dep-bump merges), which is exactly how #530's
+# baseline regressed. A stopword is SHA-independent. See #537 (regression of #530).
+description = "Test idempotency-key fixture 'orch_abc_SUB-1' (not a real credential)."
+stopwords = ["orch_abc_SUB-1"]
+
 # Catch bare 12-digit AWS account IDs. The default ruleset does not flag these,
 # which is how a real account ID reached a committed comment in the #236 integ
 # work. RE2 (Go) has no lookarounds, so the non-digit neighbours are captured in

.gitleaksignore

@@ -6,9 +6,7 @@
 0dca2171f244f693ac7c649ecf376d1ce6af2b38:docs/backlog/CLI_COGNITO_NEW_PASSWORD_CHALLENGE.md:aws-account-id:5
 0dca2171f244f693ac7c649ecf376d1ce6af2b38:docs/diagrams/phase3-cedar-hitl.drawio:aws-account-id:28
 
-# False positive: generic-api-key on a test idempotency-key fixture
-# ('orch_abc_SUB-1', not a real credential) in a file that no longer exists at
-# HEAD — it was removed when the #76 bounded-parallel perf commit was reverted
-# (e8bee5e). The finding lives only in history at f98f47a, so it can't be
-# scrubbed without rewriting shared `main`; fingerprint it instead. See #530.
-f98f47abc6f7820d7e5ce0375cf22551cb664b37:cdk/test/handlers/shared/orchestration-release.test.ts:generic-api-key:125
+# NOTE: the orch_abc_SUB-1 test-fixture false positive (formerly baselined here
+# by commit-SHA fingerprint, #530) is now suppressed SHA-independently via a
+# stopword allowlist in .gitleaks.toml — a commit-SHA fingerprint here broke when
+# history was rewritten. See #537.