From 9fa63b4dfd86174e65908b3406769473d652be56 Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 10 Nov 2026 21:22:38 +0000 Subject: [PATCH] ci(secret-scan): call the scanner in proven-cicd-and-workflows The caller named the reusable workflow of the standards repository. The Actions rule of this repository refuses a reusable workflow of a different owner, so the secret scan did not run. The caller now names hyperpolymath/proven-cicd-and-workflows at 1fd5e63, the commit that echidnabot and gitbot-fleet call. The owner is the same, so the rule permits it with no setting change. - job id stays `scan` (the called workflow checks it) - `fast-pr: false`: each run scans the full history - no `secrets:` line; `contents: read` is the whole grant - README.adoc: the lines on secret scanning name the new source Co-Authored-By: Claude Claude-Session: https://claude.ai/code/session_0136P7ZmiFSCoB3UR9Kk56rK --- .github/workflows/README.adoc | 8 ++++---- .github/workflows/secret-scanner.yml | 27 +++++++++++++++++---------- 2 files changed, 21 insertions(+), 14 deletions(-) diff --git a/.github/workflows/README.adoc b/.github/workflows/README.adoc index 298de36..de681fc 100644 --- a/.github/workflows/README.adoc +++ b/.github/workflows/README.adoc @@ -18,10 +18,10 @@ either loses real function — keep both. == Secret scanning is single-sourced -`secret-scanner.yml` calls the standards reusable (gitleaks + a Rust-secrets -check). An inline TruffleHog job was removed: the reusable deliberately retired -TruffleHog as redundant with gitleaks, so re-adding it was duplicated work, not -extra coverage. +`secret-scanner.yml` calls the reusable scanner of +`hyperpolymath/proven-cicd-and-workflows` at a pinned commit (gitleaks, a +Rust-secrets check and a shell-secrets check). An inline TruffleHog job was +removed earlier as redundant with gitleaks; do not add it again. == SAST tools are complementary, not redundant diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index ad4f4ef..12630c4 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -1,4 +1,18 @@ # SPDX-License-Identifier: MPL-2.0 +# Caller of the estate secret scanner in hyperpolymath/proven-cicd-and-workflows, +# at the commit that echidnabot and gitbot-fleet call. The called workflow runs +# gitleaks, a Rust-secrets check and a shell-secrets check. +# +# The earlier caller named the standards repository. It did not start: each +# run ended at creation, with no job and no check. +# +# Boundaries, as in the gitbot-fleet caller: +# * The job id is `scan`. The called workflow reads this file and refuses a +# caller that has a different job id or a pin that is not a full SHA. +# * `fast-pr` is false: each run scans the full history. +# * No `secrets:` line. The called workflow declares no workflow_call secret. +# * `contents: read` is the whole grant. +# See .github/workflows/README.adoc. name: Secret Scanner on: pull_request: @@ -9,17 +23,10 @@ concurrency: cancel-in-progress: true permissions: contents: read -# Single secret scanner. The standards reusable runs gitleaks (+ a Rust-secrets -# check). An inline TruffleHog job previously lived here, but the reusable -# DELIBERATELY retired TruffleHog as redundant (gitleaks gives sufficient -# coverage at lower cost — see the reusable's header). Re-adding it was -# duplicated work, not extra coverage, so it has been removed. See -# .github/workflows/README.adoc. jobs: scan: permissions: - actions: read - security-events: write contents: read - # No `secrets:` line. The called workflow uses only the automatic token. - uses: metadatastician/standards/.github/workflows/secret-scanner-reusable.yml@db12a6ad3ef9076d5f7bdcf98d7d15cf8547555a + uses: hyperpolymath/proven-cicd-and-workflows/.github/workflows/secret-scanner-reusable.yml@1fd5e6371a50f0fc3687206a5adca0cdf7b39aa6 + with: + fast-pr: false