Repository navigation
fix(ci): call the secret scanner from proven-cicd-and-workflows - #43
Conversation
The caller used metadatastician/standards, which this repository's Actions settings do not allow, so every run failed at startup with zero jobs and the scan / gitleaks context was never reported. Call the published cicd-suite scanner at the pin gitbot-fleet and contractiles use (1fd5e63), with fast-pr false, contents: read only, and no `secrets: inherit`. actions.lock is left as it is: regenerating it here would also prune the reusable-workflow entries of other workflows. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0136P7ZnmBahbhfkFEP6ark4
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 5 minutes. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. |
|
Codex Review Summary: ❌ FailedThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
Why
secret-scanner.ymlcalledmetadatastician/standards/.github/workflows/secret-scanner-reusable.yml. This repository's Actions settings do not allow reusable workflows from that owner, so every run failed at startup with 0 jobs.scan / gitleakswas never reported, and each push sent a "Run failed" email.What
The caller now uses the published cicd-suite scanner owned by hyperpolymath, at the pin that gitbot-fleet and contractiles (hyperpolymath/contractiles#75) use:
hyperpolymath/proven-cicd-and-workflows/.github/workflows/secret-scanner-reusable.yml@1fd5e6371a50f0fc3687206a5adca0cdf7b39aa6fast-pr: false,contents: readonly, and nosecrets: inherit.actions.lockis unchanged: its entry for this workflow is already[].Testing
In contractiles the same caller reported
scan / gitleaks,scan / rust-secretsandscan / shell-secretsas success on its PR and onmain. This PR's own run is the test here.Generated by Claude Code