Repository navigation
fix(ci): call the secret scanner from proven-cicd-and-workflows - #75
Merged
Merged
Conversation
The ruleset requires the scan / gitleaks context, but the caller pinned metadatastician/standards@571cc73 and every run failed at startup with zero jobs, so no PR could report it. Call the published cicd-suite scanner at the pin gitbot-fleet uses (1fd5e63), with fast-pr false, contents: read only, and no `secrets: inherit`. actions.lock is unchanged: its entry for this workflow is already [], as in gitbot-fleet. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0136P7ZnmBahbhfkFEP6ark4
Contributor
|
Caution Review failedThe pull request is closed. Summary
Merge Risk:
 |
|
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
This was referenced Nov 10, 2026
hyperpolymath
added a commit
to hyperpolymath/januskey
that referenced
this pull request
Nov 10, 2026
## Why `secret-scanner.yml` called `metadatastician/standards/.github/workflows/secret-scanner-reusable.yml`. This repository's Actions settings do not allow reusable workflows from that owner, so every run failed at startup with 0 jobs. `scan / gitleaks` was never reported, and each push sent a "Run failed" email. ## What The caller now uses the published cicd-suite scanner owned by hyperpolymath, at the pin that gitbot-fleet and contractiles (hyperpolymath/contractiles#75) use: - `hyperpolymath/proven-cicd-and-workflows/.github/workflows/secret-scanner-reusable.yml@1fd5e6371a50f0fc3687206a5adca0cdf7b39aa6` - `fast-pr: false`, `contents: read` only, and no `secrets: inherit`. `actions.lock` is unchanged. `gh actions-lock` would also prune the reusable-workflow entries of other workflows here, so it was not run. ## Testing In contractiles the same caller reported `scan / gitleaks`, `scan / rust-secrets` and `scan / shell-secrets` as success on its PR and on `main`. This PR's own run is the test here. --- _Generated by [Claude Code](https://claude.ai/code/session_0136P7ZnmBahbhfkFEP6ark4)_ Co-authored-by: Claude <noreply@anthropic.com>
hyperpolymath
added a commit
to hyperpolymath/choreographic-types
that referenced
this pull request
Nov 10, 2026
## Why `secret-scanner.yml` called `metadatastician/standards/.github/workflows/secret-scanner-reusable.yml`. This repository's Actions settings do not allow reusable workflows from that owner, so every run failed at startup with 0 jobs. `scan / gitleaks` was never reported, and each push sent a "Run failed" email. ## What The caller now uses the published cicd-suite scanner owned by hyperpolymath, at the pin that gitbot-fleet and contractiles (hyperpolymath/contractiles#75) use: - `hyperpolymath/proven-cicd-and-workflows/.github/workflows/secret-scanner-reusable.yml@1fd5e6371a50f0fc3687206a5adca0cdf7b39aa6` - `fast-pr: false`, `contents: read` only, and no `secrets: inherit`. `actions.lock` is unchanged: its entry for this workflow is already `[]`. ## Testing In contractiles the same caller reported `scan / gitleaks`, `scan / rust-secrets` and `scan / shell-secrets` as success on its PR and on `main`. This PR's own run is the test here. --- _Generated by [Claude Code](https://claude.ai/code/session_0136P7ZnmBahbhfkFEP6ark4)_ Co-authored-by: Claude <noreply@anthropic.com>
hyperpolymath
added a commit
to hyperpolymath/panll
that referenced
this pull request
Nov 10, 2026
## Why `secret-scanner.yml` called `metadatastician/standards/.github/workflows/secret-scanner-reusable.yml`. This repository's Actions settings do not allow reusable workflows from that owner, so every run failed at startup with 0 jobs. `scan / gitleaks` was never reported, and each push sent a "Run failed" email. ## What The caller now uses the published cicd-suite scanner owned by hyperpolymath, at the pin that gitbot-fleet and contractiles (hyperpolymath/contractiles#75) use: - `hyperpolymath/proven-cicd-and-workflows/.github/workflows/secret-scanner-reusable.yml@1fd5e6371a50f0fc3687206a5adca0cdf7b39aa6` - `fast-pr: false`, `contents: read` only, and no `secrets: inherit`. The old caller's `pull-requests: write` grant is dropped; the callee does not request it. `actions.lock` is unchanged. ## Testing In contractiles the same caller reported `scan / gitleaks`, `scan / rust-secrets` and `scan / shell-secrets` as success on its PR and on `main`. This PR's own run is the test here. --- _Generated by [Claude Code](https://claude.ai/code/session_0136P7ZnmBahbhfkFEP6ark4)_ Co-authored-by: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The
mainruleset requires thescan / gitleaksstatus check.secret-scanner.ymlcalledhyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@571cc73, and every run of it failed at startup with 0 jobs (for example run 42703228097 on #74, and run 42499662578 onmain). So the required context was never reported, and no PR could merge without a bypass. This blocks #74.What
.github/workflows/secret-scanner.ymlnow calls the published cicd-suite scanner, as gitbot-fleet does since hyperpolymath/gitbot-fleet#663:uses: hyperpolymath/proven-cicd-and-workflows/.github/workflows/secret-scanner-reusable.yml@1fd5e6371a50f0fc3687206a5adca0cdf7b39aa6, the same pin as gitbot-fleet.fast-pr: false, so every run scans full history.contents: readis the only grant, which is exactly what the callee's jobs declare.secrets: inherit. The callee declares noworkflow_callsecret and installs its own checksum-pinned Gitleaks.The callee's
gitleaksjob producesscan / gitleaks. Its supplemental matrix also reportsscan / rust-secretsandscan / shell-secrets.actions.lockis unchanged. Its entry for this workflow is already[], as gitbot-fleet's is for the same caller.Testing
uses:line parses (yq).actionlintis not installed in this session.scan / gitleaks.Generated by Claude Code