[hyperpolymath]

Summary

The secret scan of this repository does not run. secret-scanner.yml calls a reusable workflow of the standards repository, and the Actions rule of this repository refuses a reusable workflow of a different owner.

This PR points the caller at hyperpolymath/proven-cicd-and-workflows at 1fd5e63. That is the commit that echidnabot (hyperpolymath/echidnabot#205) and gitbot-fleet call. The owner is the same as the owner of this repository, so the rule permits the call with no setting change.

Changes

• secret-scanner.yml:
  • uses: names hyperpolymath/proven-cicd-and-workflows/.github/workflows/secret-scanner-reusable.yml@1fd5e6371a50f0fc3687206a5adca0cdf7b39aa6.
  • The job id stays scan. The called workflow reads the caller file and refuses a different job id or a pin that is not a full SHA.
  • fast-pr: false: each run scans the full history.
  • The job grant becomes contents: read only. The called workflow requests nothing more.
  • The triggers and the concurrency: key do not change. The called workflow has no concurrency: key.
• README.adoc (workflows): the lines on secret scanning name the new source.

RSR Quality Checklist

Required

• Tests pass (just test or equivalent): not run, the change is 1 workflow file and 1 document
• Code is formatted (just fmt or equivalent): not run, same reason
• Linter is clean (no new warnings or errors): not run locally, the PR checks give the result
• No banned language patterns (no TypeScript, no npm/bun, no Go/Python)
• No unsafe blocks without // SAFETY: comments
• No banned functions (believe_me, unsafeCoerce, Obj.magic, Admitted, sorry)
• SPDX license headers present on all new/modified source files
• No secrets, credentials, or .env files included

As Applicable

• Documentation updated: .github/workflows/README.adoc

Testing

• The uses: line matches the pattern that the called workflow applies to its caller (checked with the same regular expression).
• yq parses the file.
• Read at 1fd5e63: the called workflow has the jobs gitleaks, rust-secrets and shell-secrets, declares no workflow_call secret, and requests contents: read only.
• Static check before the run: this repository has 0 Rust files, and the 4 patterns of the shell-secrets rule match 0 lines in its 29 shell files.

Not verified before the push:

• The gitleaks result on the full history. The run on this pull request is the first evidence. A finding there is a finding in the history of this repository, not a fault of this change.

---

Generated by Claude Code

[coderabbitai]

Caution

Review failed

The pull request is closed.

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[chatgpt-codex-connector]

Codex Review Summary: ❌ Failed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	❌ Failed 2026-11-10T21:23:49.087482Z We couldn’t complete this review. Comment @codex review to try again.	9fa63b4	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.