From 600d34e647569d0d958f13fa8804b9e54afdcb5e Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 10 Nov 2026 21:37:42 +0000
Subject: [PATCH] fix(ci): call the secret scanner from
 proven-cicd-and-workflows

The caller used metadatastician/standards, which this repository's Actions
settings do not allow, so every run failed at startup with zero jobs and the
scan / gitleaks context was never reported. Call the published cicd-suite
scanner at the pin gitbot-fleet and contractiles use (1fd5e63), with
fast-pr false, contents: read only, and no `secrets: inherit`.

actions.lock is left as it is: regenerating it here would also prune the
reusable-workflow entries of other workflows.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0136P7ZnmBahbhfkFEP6ark4
---
 .github/workflows/secret-scanner.yml | 38 +++++++++++++++++++---------
 1 file changed, 26 insertions(+), 12 deletions(-)

diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml
index 50dc003..504facc 100644
--- a/.github/workflows/secret-scanner.yml
+++ b/.github/workflows/secret-scanner.yml
@@ -1,27 +1,41 @@
 # SPDX-License-Identifier: MPL-2.0
-# Calls the estate's shared secret scanner (gitleaks + rust-secrets +
-# shell-secrets).
+# This workflow is managed by gh actions-lock.
+name: Secret Scanner
+
+# Calls the published cicd-suite scanner, as gitbot-fleet does. The context
+# this repository's ruleset requires, scan / gitleaks, is produced by the
+# callee's gitleaks job (its supplemental matrix also reports
+# scan / rust-secrets and scan / shell-secrets).
+#
+# The previous caller called metadatastician/standards, which this
+# repository's Actions settings do not allow, so every run failed at
+# startup with zero jobs.
 #
-# No `secrets:` line: the reusable workflow declares no secrets and reads
-# none, and `secrets: inherit` would forward every secret this repository
-# can see (CWE-250; standards#1108 §6b, in the workflow's own header).
-name: "Secret Scanner"
+# Boundaries:
+#   * `fast-pr` stays false: every run scans full history.
+#   * No `secrets:` line. The callee declares no workflow_call secret and
+#     installs its own checksum-pinned binary, so `secrets: inherit` would
+#     forward every repository and organisation secret for no benefit.
+#   * `contents: read` is the whole grant the callee's jobs declare.
+
 on:
+  pull_request:
   push:
     branches: [main]
-  pull_request:
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
 permissions:
-  actions: read
   contents: read
 
 jobs:
   scan:
-    # The same standards commit as scorecard.yml. gh-actions-lock v0.4.1
-    # does not lock external reusable calls; keep this full SHA pin.
-    # The repository moved owners; retain the already-reviewed commit.
-    uses: metadatastician/standards/.github/workflows/secret-scanner-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66
+    # This job-level block REPLACES the workflow-level one. Granting less than
+    # the callee's jobs declare rejects the run at startup with zero jobs.
+    permissions:
+      contents: read
+    uses: hyperpolymath/proven-cicd-and-workflows/.github/workflows/secret-scanner-reusable.yml@1fd5e6371a50f0fc3687206a5adca0cdf7b39aa6
+    with:
+      fast-pr: false