From 2af07334a89107b3083b4a06ba4da71a58b6c5a6 Mon Sep 17 00:00:00 2001
From: Hayden <154503486+groupthinking@users.noreply.github.com>
Date: Sun, 2 Aug 2026 07:32:45 -0500
Subject: [PATCH] docs: reference GEMINI_API_KEY env var in curl examples

Two Gemini `curl` snippets in the universal-automation-service prototype
notes embedded a scrubbed credential marker directly in an auth header:

    -H 'X-goog-api-key: REDACTED_GOOGLE_API_KEY_ROTATE' \

That marker is a leftover from the secret purge, not a live key, but its
shape trips gitleaks' `curl-auth-header` rule. That rule does not exist in
the version CI currently pins (`GITLEAKS_VERSION=8.18.4` in
.github/workflows/secret-scan.yml), so the Secret Scan job is green today
and the problem is invisible -- it only detonates when somebody bumps the
pin, at which point Secret Scan fails on `main` for a reason unrelated to
their change.

Fix the cause rather than allowlisting the symptom: the snippets now read
the key from the environment, which both removes the trigger and is the
pattern the docs should be teaching. No entry is added to .gitleaks.toml,
so no future real credential is masked by this change.

The other ~18 `REDACTED_GOOGLE_API_KEY_ROTATE` occurrences in these docs
are `export GEMINI_API_KEY="..."` lines and historical incident notes.
They match no gitleaks rule and are left untouched.

Verified with both the pinned and a newer gitleaks:

    gitleaks detect --no-git --config .gitleaks.toml --redact --exit-code 1

    version           before          after
    8.18.4 (CI pin)   0 leaks         0 leaks
    8.30.0            2 leaks         0 leaks

Refs #1217

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---
 .../universal-automation-service/TECHNICAL_NOTES.md           | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/docs/knowledge_prototypes/universal-automation-service/TECHNICAL_NOTES.md b/docs/knowledge_prototypes/universal-automation-service/TECHNICAL_NOTES.md
index 235e6d4f8..bcc607e5d 100644
--- a/docs/knowledge_prototypes/universal-automation-service/TECHNICAL_NOTES.md
+++ b/docs/knowledge_prototypes/universal-automation-service/TECHNICAL_NOTES.md
@@ -29,7 +29,7 @@ self.model = "gemini-2.0-flash-exp"
 ```bash
 curl "https://generativelanguage.googleapis.com/v1beta/models/gemini-2.0-flash-exp:generateContent" \
   -H 'Content-Type: application/json' \
-  -H 'X-goog-api-key: REDACTED_GOOGLE_API_KEY_ROTATE' \
+  -H "X-goog-api-key: ${GEMINI_API_KEY}" \
   -X POST -d '{"contents": [{"parts": [{"text": "test"}]}]}'
 ```
 
@@ -200,7 +200,7 @@ EventRelay      : ❌ FAIL
 ```bash
 curl "https://generativelanguage.googleapis.com/v1beta/models/gemini-2.0-flash-exp:generateContent" \
   -H 'Content-Type: application/json' \
-  -H 'X-goog-api-key: REDACTED_GOOGLE_API_KEY_ROTATE' \
+  -H "X-goog-api-key: ${GEMINI_API_KEY}" \
   -X POST \
   -d '{"contents": [{"parts": [{"text": "Hello"}]}]}'
 ```