Repository navigation
fix(ci): call the secret scanner from proven-cicd-and-workflows - #500
Conversation
hyperpolymath/proven-cicd is being retired; its commits were merged into hyperpolymath/proven-cicd-and-workflows (proven-cicd-and-workflows#95). The pin moves from proven-cicd@a12b2b4 to proven-cicd-and-workflows@ 1fd5e63 (the #94 merge). a12b2b4 is an ancestor of 1fd5e63, and the reusable workflow differs in one line only: its caller check also admits the new repository name, which this call needs. Co-Authored-By: Claude <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0136P7ZmAsYpFA9gxfQLF3F6 Signed-off-by: Claude <noreply@anthropic.com>
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 50 minutes. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. |
|
This security review couldn’t start because the paying account has exhausted its Codex allowance and has insufficient available credits. The payer can check their balance and add credits in the Codex usage dashboard, then try again. If you do not manage the paying account, contact this repository's admins. |
Codex Review Summary: ✅ CompletedThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
## Summary The Workflow Security Linter refresh and the committed `actions.lock` produced different locks. This PR makes them agree, using the form the owner chose: the form that the standards refresh tool writes. The candidate is applied without edits, from the "Prepare official actions.lock refresh candidate" step of run 42897428598 on `18828c3`. That run reports `close-lock: 0 dangling refs`, `prune-stale: oracle vetoes 0` and `actions.lock is in sync`. It restores the reusable-workflow records that #495 removed: 8 job-level reusable calls, with their transitive actions. ## Why this is safe for governance #495 removed these records as stale. The governance gate accepts them, however. Its verifier (standards `a797d30`, `scripts/update-actions-lock.sh`, `verify_lock_coverage`) accepts a `stale` finding when the workflow calls that exact `owner/repo/.github/workflows/…@ref`. The governance log on `d98b0e2` shows that 7 of the 8 records were accepted. It rejected only 1: `security-scan.yml → panic-attack@be6ac46`, which was stale because #491 had moved the call to `55ffcc9`. This form passed governance on `453fe3b` (#496). The refresh run above printed the same "Accepted reusable-workflow lock coverage" line for each of the 8 current calls. ## Correction #500 said that applying this candidate would turn governance red. That was wrong, for the reason above. ## Test plan - [ ] governance / Actions lockfile verify passes on this head. --- _Generated by [Claude Code](https://claude.ai/code/session_0136P7ZmAsYpFA9gxfQLF3F6)_ Co-authored-by: Claude <noreply@anthropic.com>
Summary
hyperpolymath/proven-cicd is being retired. Its commits were merged into hyperpolymath/proven-cicd-and-workflows (proven-cicd-and-workflows#95). This PR moves the Secret Scanner call to the new repository before the owner deletes the old one.
hyperpolymath/proven-cicd/.github/workflows/secret-scanner-reusable.yml@a12b2b4hyperpolymath/proven-cicd-and-workflows/.github/workflows/secret-scanner-reusable.yml@1fd5e63(the merge of proven-cicd-and-workflows#94)a12b2b4 is an ancestor of 1fd5e63. The reusable workflow differs in 1 line: the caller check also admits
proven-cicd-and-workflows. This call needs that line.actions.lock is not changed
Since #495, the lock does not record job-level reusable-workflow calls: governance installs gh-actions-lock v0.2.0, which rejects those records as stale. The entry for
secret-scanner.ymlstays[].The Workflow Security Linter refresh candidate (run 42889686324) still adds those records back: 149 lines, for this call and 7 other reusable calls. Applying it would undo #495 and turn governance red again, so this PR does not apply it. That refresh step and the governance gate now disagree; this is a separate defect for the owner.
Test plan
Generated by Claude Code