{
  "archival_format": "json-checksum-map-entries-v1",
  "original_sha256": "d3658a4dd8ea9c31bed5ce7fc99f2e1a79ac89e59d9e3dcebb3fb517409abd27",
  "converted_map_field": "source_hashes",
  "reason": "Public non-secret ConfigMap source checksum was classified as generic-api-key when its filename was used as a JSON property name. Structured path/sha256 entries preserve exact historical reconstruction without detector exceptions.",
  "document": {
    "chart": "gitea-12.5.0",
    "chart_sha256": "2d6f35f3d1ff0cfcab0f22142d20a1d6405fa974a79d7a18000904d233131823",
    "source_hashes": [
      {
        "path": "helm/forgejo-values.yaml",
        "sha256": "e97aa62fe767f4dc55f2c68c7ae1b69e61e632826a8ba3ccb4ffaca6e302174c"
      },
      {
        "path": "Makefile",
        "sha256": "6bd20555631eb4c22e0729779d6c24d6888a4e6d555ab1f03083697016d42b15"
      },
      {
        "path": "manifests/forgejo-secret-scan-template.yaml",
        "sha256": "8fad71aff5a25d8e31289072b9c06c6ec74ac74fedafc54dde7177bfe187c96a"
      }
    ],
    "rendered_target": "Deployment forgejo/forgejo-gitea",
    "file_mounts_checked": [
      "gitea",
      "init-directories",
      "init-app-ini",
      "configure-gitea"
    ],
    "encoded_setting": {
      "name": "GITEA__GIT_0X2E_CONFIG__INIT_0X2E_TEMPLATEDIR",
      "value": "/opt/forge-secret-template"
    },
    "scope": "Nonsecret owner source render only. No production config/Secret read. Live rollout uses a narrowly scoped patch, not full Helm reapplication."
  }
}