fix(scan): stop generic-bearer flagging test fixtures, and honour .forge/waivers

[teragrid]

This PR addresses:
No existing issue. Found running forge scan security on a real Next.js/Supabase repo, where it printed FORGE-3000 … 56 finding(s) detected; fix before shipping and exited non-zero, every time.

Scope

• Bug fix
• New feature (core)
• New feature (plugin)
• Documentation / Docs
• Refactor / Tooling

Checklist

• Tests added: unit + scanner-level + CLI-level (see below). Honest note: I wrote the code first and the tests after, then mutation-checked the tests (below) rather than watching them fail beforehand.
• Fixes: #NNN: no issue exists; happy to file one if maintainers want it.
• Signed-off-by: all three commits use git commit -s.
• Pre-push checklist: make check not run in full: golangci-lint/govulncheck aren't installed on this machine. Ran instead: gofmt -s, go vet ./..., go build ./..., go test -race on the three affected packages and go test -count=1 ./... on the whole repo (77 packages ok). Please let CI run lint/vuln.

Description

Two problems, one root cause: the only way to get a clean scan on a project with fixtures was to edit the code.

1. generic-bearer flags fixtures and doc placeholders. The rule matches any quoted 16+ char literal assigned to a name containing token/secret/password/api-key. On the repo above that was 56 findings, all placeholders (test_access_token, whsec_placeholder, mock-refresh-token, sbp_your_token_here, YOUR_ACCESS_TOKEN), so the gate was permanently red and a real hit could hide in it.

A value is now recognised as a placeholder structurally (no directory is blanket-skipped): it must be a phrase — 2+ segments split on -/_, each a plain lower/UPPER/Capitalised word with ≤6 trailing digits, or a short number — and either contain a marker word (test, mock, fake, dummy, example, sample, placeholder, changeme, invalid, your, …) or sit in test code.

Still reported, in production and test code: anything opaque — sk_live_…/sk_test_…, real whsec_…, hex, UUIDs, base62, JWT headers, mixed-case or letter/digit blends, single long segments. Only generic-bearer changed: the AWS / sk- / GitHub-token / private-key rules are untouched and still fire in tests. The finding's secret field is byte-identical to before.

2. The waiver registry was never wired in. internal/waiver (DEV-M1-17) loads .forge/waivers/*.yml and is unit-tested, but nothing outside the package called it, so there was no in-tool way to accept one finding. ApplyWaivers now runs in forge scan <family> and in the ship checkpoint's security scan:

• waived findings leave the result and don't affect count/status/exit code; they are counted in new ScanResult.Waived ("waived" in --json, waived: in text);
• fail closed: a waiver missing rationale, approved_by or expires_at is an error, not a silent exemption;
• an expired waiver is never honoured; the finding stays and note names the lapsed waiver;
• fixed IsWaived returning "expired" at the first expired match even when a valid waiver followed, which made renewing by adding a new entry impossible.

Evidence (real repo, not synthetic)

	findings	exit
forge 1.10.8	56	1
this branch	3	1
this branch + 2 waiver files (3 findings)	0 (waived: 3)	0

The 3 that remain are what a heuristic should not guess: a documented, public webhook verify token in production code and two camelCase fixtures in one test file. Forge 1.10.8 ignores the waiver files (still exit 1 on the same tree), so a project can commit them before upgrading.

Tests (all pass; whole repo go test ./... = 77 packages ok)

• placeholder_test.go: 14 real-world placeholders → recognised; 12 real-looking secrets × {src, test path} → still flagged; phrase-in-production-still-flagged; boundaries; isTestPath.
• scanners_placeholder_test.go (TC-FP-07/08/09): placeholders not reported; real secrets in tests still reported; provider rules unaffected in test files; Secret field unchanged.
• waivers_test.go: file-scoped and rule-wide waivers, other rule in same file not waived, expiry, renewal, incomplete/blank/malformed waivers, and a CLI test where the exit code flips only because of the waiver.
• Mutation-checked: disabling the placeholder skip fails TC-FP-07; removing the plain-word check lets Stripe/whsec/UUID/etc. through and fails the negative tests; dropping the ApplyWaivers call fails both CLI tests; reverting the IsWaived fix fails both renewal tests.

Trade-offs for review

• A passphrase-style literal inside test code (correct-horse-battery-staple in tests/) is now treated as a fixture. In production code it is still reported. That is the deliberate cost of not flagging every fixture; tell me if you'd rather require a marker word everywhere.
• The marker list and the ≤6-digit limit are judgment calls; both are one-line constants in placeholder.go.

Noticed, not changed here

• --since <ref> ignores the ref: it calls loadScanBaseline(root, scanner), which reads .forge/scan-history, so results differ between checkouts. Separate bug; happy to look at it in its own PR.
• Test fixtures under tests/ in this repo contain intentionally broken .go files, so a bare gofmt -l . prints parse errors (unrelated to this change).

🤖 Generated with Claude Code