fix(ci): call the secret scanner from proven-cicd-and-workflows

.github/workflows/secret-scanner.yml

@@ -1,21 +1,41 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
-# This workflow is managed by gh actions-lock.
 name: Secret Scanner
+
+# Calls the published cicd-suite scanner, as gitbot-fleet does. The context
+# this repository's ruleset requires, scan / gitleaks, is produced by the
+# callee's gitleaks job (its supplemental matrix also reports
+# scan / rust-secrets and scan / shell-secrets).
+#
+# The previous caller pinned hyperpolymath/standards@571cc73 and failed at
+# startup with zero jobs on every run, so the required context was never
+# reported.
+#
+# Boundaries:
+#   * `fast-pr` stays false: every run scans full history.
+#   * No `secrets:` line. The callee declares no workflow_call secret and
+#     installs its own checksum-pinned binary, so `secrets: inherit` would
+#     forward every repository and organisation secret for no benefit.
+#   * `contents: read` is the whole grant the callee's jobs declare.
+
 on:
   pull_request:
   push:
     branches: [main]
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
+
 permissions:
-  actions: read
   contents: read
+
 jobs:
   scan:
+    # This job-level block REPLACES the workflow-level one. Granting less than
+    # the callee's jobs declare rejects the run at startup with zero jobs.
     permissions:
       contents: read
-    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@571cc734cd69fb846032ec77a662aa8ee4fc32cd
-    secrets: inherit
+    uses: hyperpolymath/proven-cicd-and-workflows/.github/workflows/secret-scanner-reusable.yml@1fd5e6371a50f0fc3687206a5adca0cdf7b39aa6
+    with:
+      fast-pr: false