ci(gitleaks): baseline

.gitleaks.toml

@@ -0,0 +1,2 @@
+[extend]
+useDefault = true

crates/pheno-config/examples/cascade.rs

@@ -33,7 +33,10 @@ fn main() -> Result<(), Box<dyn std::error::Error>> {
 
     // Show which layer won for each field
     println!("\nField provenance:");
-    println!("  server.port = {} (env overrides > file > default)", config.server.port);
+    println!(
+        "  server.port = {} (env overrides > file > default)",
+        config.server.port
+    );
 
     Ok(())
 }

crates/pheno-config/examples/validation.rs

@@ -33,7 +33,10 @@ impl Validate for ServerConfig {
         if self.max_connections == 0 || self.max_connections > 10_000 {
             return Err(AppError::Validation {
                 field: "server.max_connections".into(),
-                message: format!("max_connections must be 1..=10000, got {}", self.max_connections),
+                message: format!(
+                    "max_connections must be 1..=10000, got {}",
+                    self.max_connections
+                ),
             });
         }
         Ok(())

crates/pheno-config/tests/toml_merge_test.rs

@@ -11,9 +11,7 @@
 use std::env;
 use std::sync::Mutex;
 
-use pheno_config::{
-    combine, load_from_env, load_from_toml_file, ConfigBuilder, ConfigError,
-};
+use pheno_config::{combine, load_from_env, load_from_toml_file, ConfigBuilder, ConfigError};
 
 // Process-wide lock that serializes env-var access. The default
 // cargo test harness runs tests in parallel worker threads, but
@@ -84,18 +82,28 @@ const PREFIX_CRE: &str = "PHENO_CONFIG_V020_CRE";
 /// as a defense-in-depth (covers any test that uses a non-prefix
 /// var like combine()'s file-parse-error case).
 const KNOWN_V020_VARS: &[&str] = &[
-    "PHENO_CONFIG_V020_TFV_URL", "PHENO_CONFIG_V020_TFV_PORT",
-    "PHENO_CONFIG_V020_TFM_URL", "PHENO_CONFIG_V020_TFM_PORT",
-    "PHENO_CONFIG_V020_TFMA_URL", "PHENO_CONFIG_V020_TFMA_PORT",
-    "PHENO_CONFIG_V020_TFMR_URL", "PHENO_CONFIG_V020_TFMR_PORT",
-    "PHENO_CONFIG_V020_CFP_URL", "PHENO_CONFIG_V020_CFP_PORT",
-    "PHENO_CONFIG_V020_CEO_URL", "PHENO_CONFIG_V020_CEO_PORT",
-    "PHENO_CONFIG_V020_CEO_LOG_LEVEL", "PHENO_CONFIG_V020_CEO_DB_PATH",
+    "PHENO_CONFIG_V020_TFV_URL",
+    "PHENO_CONFIG_V020_TFV_PORT",
+    "PHENO_CONFIG_V020_TFM_URL",
+    "PHENO_CONFIG_V020_TFM_PORT",
+    "PHENO_CONFIG_V020_TFMA_URL",
+    "PHENO_CONFIG_V020_TFMA_PORT",
+    "PHENO_CONFIG_V020_TFMR_URL",
+    "PHENO_CONFIG_V020_TFMR_PORT",
+    "PHENO_CONFIG_V020_CFP_URL",
+    "PHENO_CONFIG_V020_CFP_PORT",
+    "PHENO_CONFIG_V020_CEO_URL",
+    "PHENO_CONFIG_V020_CEO_PORT",
+    "PHENO_CONFIG_V020_CEO_LOG_LEVEL",
+    "PHENO_CONFIG_V020_CEO_DB_PATH",
     "PHENO_CONFIG_V020_CEO_FEATURE_FLAGS",
-    "PHENO_CONFIG_V020_CNE_URL", "PHENO_CONFIG_V020_CNE_PORT",
-    "PHENO_CONFIG_V020_CNE_LOG_LEVEL", "PHENO_CONFIG_V020_CNE_DB_PATH",
+    "PHENO_CONFIG_V020_CNE_URL",
+    "PHENO_CONFIG_V020_CNE_PORT",
+    "PHENO_CONFIG_V020_CNE_LOG_LEVEL",
+    "PHENO_CONFIG_V020_CNE_DB_PATH",
     "PHENO_CONFIG_V020_CNE_FEATURE_FLAGS",
-    "PHENO_CONFIG_V020_CRE_URL", "PHENO_CONFIG_V020_CRE_PORT",
+    "PHENO_CONFIG_V020_CRE_URL",
+    "PHENO_CONFIG_V020_CRE_PORT",
     "PHENO_CONFIG_V020_CRE_DB_PATH",
 ];
 
@@ -300,7 +308,11 @@ feature_flags = ["from_file"]
     // ["from_env", "shared"] are appended (deduped).
     assert_eq!(
         cfg.feature_flags,
-        vec!["from_file".to_owned(), "from_env".to_owned(), "shared".to_owned()]
+        vec![
+            "from_file".to_owned(),
+            "from_env".to_owned(),
+            "shared".to_owned()
+        ]
     );
     let _ = std::fs::remove_file(&path);
 }

crates/pheno-config/tests/tracing_test.rs

@@ -13,9 +13,7 @@ use tracing_test::traced_test;
 fn build_emits_span() {
     let span = tracing::info_span!("config_build");
     let _enter = span.enter();
-    let result = ConfigBuilder::new()
-        .load_env("PHENO_CONFIG")
-        .build();
+    let result = ConfigBuilder::new().load_env("PHENO_CONFIG").build();
     tracing::info!(?result, "build complete");
     // Either Ok or an env error is fine; we just want to verify the span emit path
     assert!(logs_contain("build complete"));