From 9070c0d0a52d3e711c37003b1a677069fc559748 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 10 Nov 2026 21:22:12 +0000
Subject: [PATCH] fix(ci): call the secret scanner from
 proven-cicd-and-workflows

The ruleset requires the scan / gitleaks context, but the caller pinned
hyperpolymath/standards@571cc73 and every run failed at startup with zero
jobs, so no PR could report it. Call the published cicd-suite scanner at
the pin gitbot-fleet uses (1fd5e63), with fast-pr false, contents: read
only, and no `secrets: inherit`.

actions.lock is unchanged: its entry for this workflow is already [], as
in gitbot-fleet.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0136P7ZnmBahbhfkFEP6ark4
---
 .github/workflows/secret-scanner.yml | 30 +++++++++++++++++++++++-----
 1 file changed, 25 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml
index f868b15..e0ce506 100644
--- a/.github/workflows/secret-scanner.yml
+++ b/.github/workflows/secret-scanner.yml
@@ -1,21 +1,41 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
-# This workflow is managed by gh actions-lock.
 name: Secret Scanner
+
+# Calls the published cicd-suite scanner, as gitbot-fleet does. The context
+# this repository's ruleset requires, scan / gitleaks, is produced by the
+# callee's gitleaks job (its supplemental matrix also reports
+# scan / rust-secrets and scan / shell-secrets).
+#
+# The previous caller pinned hyperpolymath/standards@571cc73 and failed at
+# startup with zero jobs on every run, so the required context was never
+# reported.
+#
+# Boundaries:
+#   * `fast-pr` stays false: every run scans full history.
+#   * No `secrets:` line. The callee declares no workflow_call secret and
+#     installs its own checksum-pinned binary, so `secrets: inherit` would
+#     forward every repository and organisation secret for no benefit.
+#   * `contents: read` is the whole grant the callee's jobs declare.
+
 on:
   pull_request:
   push:
     branches: [main]
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
+
 permissions:
-  actions: read
   contents: read
+
 jobs:
   scan:
+    # This job-level block REPLACES the workflow-level one. Granting less than
+    # the callee's jobs declare rejects the run at startup with zero jobs.
     permissions:
       contents: read
-    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@571cc734cd69fb846032ec77a662aa8ee4fc32cd
-    secrets: inherit
+    uses: hyperpolymath/proven-cicd-and-workflows/.github/workflows/secret-scanner-reusable.yml@1fd5e6371a50f0fc3687206a5adca0cdf7b39aa6
+    with:
+      fast-pr: false