# secretzero.yml
# SecretZero CLI configuration for AI-powered features.
#
# Copy this file to ./secretzero.yml (or ~/.config/secretzero/secretzero.yml)
# and customise for your environment.
#
# Configuration loading priority:
#   1. SECRETZERO_CONFIG env var (absolute path)
#   2. ./secretzero.yml (current working directory)
#   3. ~/.config/secretzero/secretzero.yml

version: "1.0"

# ---------------------------------------------------------------------------
# LLM provider configuration for AI-powered features (e.g. secretzero discover)
# ---------------------------------------------------------------------------
llm:
  # Which provider to use by default:
  #   ollama       – local, free, no data leaves your machine
  #   openai       – OpenAI cloud API (requires OPENAI_API_KEY)
  #   anthropic    – Anthropic Claude (requires ANTHROPIC_API_KEY)
  #   azure_openai – Azure-hosted OpenAI (requires AZURE_OPENAI_* vars)
  default_provider: ollama

  providers:
    # -----------------------------------------------------------------------
    # Ollama – local LLM server (recommended for privacy-first workflows)
    # Install: https://ollama.com  |  Model: ollama pull llama3.2:3b
    # -----------------------------------------------------------------------
    ollama:
      base_url: "${OLLAMA_HOST:-http://localhost:11434}"
      model: "${OLLAMA_MODEL:-llama3.2:3b}"
      # Heavier model for reasoning-intensive analysis (optional)
      reasoning_model: "${OLLAMA_REASONING_MODEL:-}"
      timeout: 120
      temperature: 0.7
      max_tokens: 4096

    # -----------------------------------------------------------------------
    # OpenAI – cloud API
    # -----------------------------------------------------------------------
    openai:
      api_key: "${OPENAI_API_KEY}"
      model: "${OPENAI_MODEL:-gpt-4o-mini}"
      organization: "${OPENAI_ORG_ID}"
      timeout: 120
      temperature: 0.7
      max_tokens: 4096

    # -----------------------------------------------------------------------
    # Anthropic – Claude models
    # -----------------------------------------------------------------------
    anthropic:
      api_key: "${ANTHROPIC_API_KEY}"
      model: "${ANTHROPIC_MODEL:-claude-3-5-sonnet-20241022}"
      timeout: 120
      temperature: 0.7
      max_tokens: 4096

    # -----------------------------------------------------------------------
    # Azure OpenAI – Azure-hosted deployment
    # -----------------------------------------------------------------------
    azure_openai:
      api_key: "${AZURE_OPENAI_API_KEY}"
      endpoint: "${AZURE_OPENAI_ENDPOINT}"
      deployment: "${AZURE_OPENAI_DEPLOYMENT}"
      api_version: "2024-02-15-preview"
      timeout: 120
      temperature: 0.7
      max_tokens: 4096

# ---------------------------------------------------------------------------
# Discovery settings (used by: secretzero discover)
# ---------------------------------------------------------------------------
discovery:
  # Disable to prevent external script execution during discovery
  allow_script_execution: false

  # Minimum confidence score (0.0–1.0) for a secret to be included in output.
  # Higher values = fewer false positives but may miss real secrets.
  confidence_threshold: 0.6

  # Maximum number of files to scan (performance guard)
  max_files: 1000

  # Glob patterns for files to scan (relative to project root)
  include_patterns:
    - "*.env*"
    - ".env"
    - ".env.*"
    - "*.yml"
    - "*.yaml"
    - "*.json"
    - "*.toml"
    - "*.tf"
    - "*.tfvars"
    - "**/.github/workflows/*.yml"
    - "**/k8s/**/*.yaml"
    - "**/kubernetes/**/*.yaml"

  # Glob patterns for paths to exclude (relative to project root)
  exclude_patterns:
    - "**/node_modules/**"
    - "**/venv/**"
    - "**/.venv/**"
    - "**/dist/**"
    - "**/build/**"
    - "**/.git/**"
    - "**/vendor/**"
    - "**/__pycache__/**"
    - "**/*.pyc"
    - "**/target/**"   # Java/Rust build outputs

# ---------------------------------------------------------------------------
# Output preferences
# ---------------------------------------------------------------------------
output:
  # Default summary format when not overridden by --format:
  #   text  – human-readable Rich console output
  #   json  – machine-readable JSON (useful for CI pipelines)
  #   yaml  – YAML summary
  format: text

  # Verbosity level:
  #   0 = quiet (errors only)
  #   1 = normal (default)
  #   2 = verbose
  #   3 = debug
  verbosity: 1

  # Enable colour output (auto-disabled in non-TTY environments)
  color: true
