Repository navigation
ci(gates): call the secret scanner and the governance bundle at the versions that gitbot-fleet calls - #201
Merged
Conversation
…ersions that gitbot-fleet calls The 2 callers named hyperpolymath/standards at 740c9d7 (June). They do not start: each run ends at creation with no job and no check (481 runs of `secret-scanner.yml`, 410 runs of `governance.yml`). So this repository has no secret scan and no governance gate at this time. gitbot-fleet has a pinned copy of this crate and calls current gates. 4 of its checks went red on lines that come from here, and this repository did not see them first. The 2 callers now name what gitbot-fleet names: - `secret-scanner.yml`: hyperpolymath/proven-cicd `secret-scanner-reusable.yml` at 03e858b, `fast-pr: false`, no `secrets:` line, `contents: read`. - `governance.yml`: metadatastician/standards `governance-reusable.yml` at ea2f4d8, with the permissions of the gitbot-fleet caller. `actions.lock` is not changed. It still records the old reference for these 2 workflows. The lock is owned by `gh actions-lock`, which is not available in this session. Co-Authored-By: Claude <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0136P7ZmiFSCoB3UR9Kk56rK
Contributor
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 40 minutes. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. |
hyperpolymath
marked this pull request as ready for review
November 10, 2026 18:25
Codex Review Summary: ❌ FailedThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
hyperpolymath
enabled auto-merge (squash)
November 10, 2026 18:25
hyperpolymath
disabled auto-merge
November 10, 2026 18:37
|
hyperpolymath
added a commit
that referenced
this pull request
Nov 10, 2026
## Summary The secret scan on `main` fails on 1 job, `scan / gitleaks` (run 42877094785 at `a045184`). This pull request removes the cause: `.gitleaks.toml`, a stale full copy of the estate baseline. This is the follow-up that #201 named ("Not in this change: `.gitleaks.toml`"). The owner decided to remove the copy. #201 merged before the change was in it, so the change is here. ## Cause - The scanner (`hyperpolymath/proven-cicd` at `03e858b`) puts its own baseline into the tree with the name `.gitleaks-estate.toml`. - When a repository has a `.gitleaks.toml`, the scanner uses that file as the config. - The `.gitleaks.toml` here was a full copy of an earlier estate baseline. It did not extend `.gitleaks-estate.toml`, so the path entry that exempts the baseline file was not in effect. - Result: the tree pass finds 3 lines in `.gitleaks-estate.toml` (lines 88 and 89, rule `generic-api-key`). The lines are fixture text in a comment of the scanner's baseline. They are not secrets, and the file is not a file of this repository. State of the scan on `main` at `a045184`: history pass 0 leaks (350 commits), Rust rule 0, shell rule 0, tree pass 3 findings. ## Changes - `.gitleaks.toml` is removed (105 lines). With no `.gitleaks.toml`, the scanner uses the baseline directly. The scan then follows the estate rule and cannot be weaker than it. Why removal and not a file that extends the baseline: the copy has no entry of its own. Each of its 14 allowlist entries is in the baseline (18 entries). A file with `[extend] path = ".gitleaks-estate.toml"` is correct on the day that this repository needs a local exemption. gitbot-fleet has that form. No other file in this repository names `.gitleaks.toml`. ## What to expect in CI **`scan / gitleaks` stays red on this pull request.** On a pull request, the scanner takes the config from the base and not from the head (`check.sh` of the scanner, lines 27 to 49 and 82). The base still has the copy. So this check cannot show the repair before the merge. This is the design of the scanner: a pull request cannot change the rules of its own scan. **The proof is the first scan on `main` after the merge.** Expected: all 3 `scan / ...` jobs pass. ## Testing - Text comparison of the 2 files: 14 of 14 entries of the copy are in the baseline at `03e858b`. - `grep` for `gitleaks.toml` in the tree after the change: 0 files. - Not verified by a gitleaks run. The session has no gitleaks binary. The expected result comes from the comparison above and from the scanner log on `main`. ## If the scan on `main` is not clean after the merge A new finding then comes from an entry that the baseline has and the copy did not have, or from a rule of the baseline. The repair is a `.gitleaks.toml` that extends the baseline with 1 justified entry. The repair is not this file again. --- _Generated by [Claude Code](https://claude.ai/code/session_0136P7ZmiFSCoB3UR9Kk56rK)_ Co-authored-by: Claude <noreply@anthropic.com>
hyperpolymath
added a commit
that referenced
this pull request
Nov 10, 2026
…203) ## Summary 5 workflows of this repository do not start: `codeql.yml`, `hypatia-scan.yml`, `mirror.yml`, `rust-ci.yml` and `scorecard.yml`. Each one calls a reusable workflow in `hyperpolymath/standards` at `740c9d7`. For `rust-ci.yml`, GitHub Actions says (run 42874779657): > error parsing called workflow ... "hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@740c9d7..." : workflow was not found. So this repository has no CodeQL scan, no Hypatia scan, no scorecard, no mirror and no shared Rust CI at this time. #201 named this as "5 more callers". **The cause is the name only.** The standards repository now has the owner `metadatastician`. `git` follows the old name. GitHub Actions does not. ## Changes **1. The owner name (`d9ed540`).** In each of the 5 `uses:` lines, `hyperpolymath/standards` becomes `metadatastician/standards`. 5 lines, 1 name each. Each caller keeps its own pinned commit, `740c9d7`. The owner chose this, and not the commit that gitbot-fleet pins (`75bd599`), for 3 reasons: - `740c9d7` is on `main` of the standards repository and is later than `75bd599`. A move to `75bd599` is a downgrade (for example 199 lines of `hypatia-scan-reusable.yml`). - gitbot-fleet has no caller for `codeql` and `rust-ci`, so it gives no reference for those 2. - `actions.lock` records `740c9d7`. After this change it differs from the workflows in the owner name only. **2. The CodeQL language (`e8276e5`), found in review.** `codeql.yml` passed no `language` input, so the called workflow used its default, `javascript-typescript`. A comment in the caller said that echidnabot is JS/TS. The repository has 55 `.rs` files and no JavaScript or TypeScript file. The caller now passes `language: rust`, the Rust-only form that the called workflow documents in its header. The comment is corrected. ## These callers do not start yet The Actions settings of this repository refuse a reusable workflow from another owner. The governance caller shows this (#201, run 42874783871). The same rule applies to these 5. - Before this change: each run ends with "workflow was not found". - After this change, and before the setting change: each run ends at creation with "not allowed". This is not a regression. - After the setting change (Settings, Actions, General: allow `metadatastician/standards`): the callers start with no more file changes. **`mirror.yml` then becomes active.** It runs on each push to `main` and sends the repository to the other forges for which a key secret exists. It has not run for some time. Decide if that is wanted before the setting change. ## Not in this change - **`.github/workflows/actions.lock`** still has 8 entries with `hyperpolymath/standards@740c9d7`, and no entry for `metadatastician/standards` or `hyperpolymath/proven-cicd`. The lock is owned by `gh actions-lock` and is not edited by hand. A person runs the tool. A lock check in the governance bundle can be red until then. The review found this too; its thread stays open. - **The comments at the end of 3 `uses:` lines** give dates in May and June 2026 for the pin. The commit `740c9d7` has the date 2026-10-19. The comments are not changed here. - **A CodeQL scan of the workflow files** (`language: actions`), as gitbot-fleet has. Not asked for, not added. ## Testing Read from the standards repository at `740c9d7` (fetched from `metadatastician/standards`): | Caller | Called file is in `740c9d7` | Inputs and secrets of the caller exist | Permissions that the called file requests | |---|---|---|---| | `codeql.yml` | yes | `language` exists; `rust` is in the documented list | `actions: read`, `contents: read`, `security-events: write`: the caller grants them | | `hypatia-scan.yml` | yes | no input passed | the same 3: the caller grants them | | `mirror.yml` | yes | the 7 key secrets are declared, none is necessary | `actions: read`, `contents: read`: the caller grants them | | `rust-ci.yml` | yes | `enable_audit` and `test_args` exist | `contents: read`: the caller grants it | | `scorecard.yml` | yes | no input passed | the 3 above and `id-token: write`: the caller grants them | - `740c9d7` is an ancestor of `main` of the standards repository (`be39f90`). - No called file has a `concurrency:` key, so a caller with `concurrency:` does not clash with it. - `yq` reads `codeql.yml` after the second commit: the job has the `uses:` value above and `with.language` is `rust`. Not verified: - A real run. No run is possible before the setting change. The first runs can show findings: these workflows have never run here at this commit. That includes the first CodeQL scan of the Rust code. - If the Actions settings permit each action that the 5 called files use. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_0136P7ZmiFSCoB3UR9Kk56rK --------- Co-authored-by: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This pull request moves the 2 dead gate callers of this repository to the versions that gitbot-fleet calls. The first run is read (2026-11-10, head
7641807).secret-scanner.ymlgovernance.ymlWhy the old callers do not start. They name
hyperpolymath/standardsat740c9d7. Forrust-ci.yml, GitHub Actions says (run 42874779657):error parsing called workflow ... "hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@740c9d7..." : workflow was not found.The file is in that commit.gitgives the samemainhead forhyperpolymath/standardsand formetadatastician/standards. The probable cause: the repository now has the ownermetadatastician, and Actions does not follow the old name. The old runs of the 2 gate callers have the same form (failureat creation, 0 jobs). Their text was not read.Correction. The first text of this pull request, and the commit message of
7641807, give the date of740c9d7as June. That is wrong. The date of the commit is 2026-10-19.Result 1: the secret scanner starts (run 42874781134)
scan / shell-secrets: pass.scan / rust-secrets: fail, on 4 lines:src/api/auth.rs45 and 48,tests/smoke.rs25 and 26. These are the 4 lines that fix(tests): mark 4 non-secret constants for the secret scan, and take the nil UUID from the type #197 marks. This was known before the run.scan / gitleaks: fail.generic-api-key, all in.gitleaks-estate.toml, lines 88 and 89.The 3 findings are not secrets, and the file is not a file of this repository. The scanner puts its own baseline into the tree with the name
.gitleaks-estate.toml. The 3 findings are fixture text in a comment of that baseline.The cause is in this repository. When a repository has a
.gitleaks.toml, the scanner uses it as the config. The.gitleaks.tomlhere is a full copy of an earlier estate baseline. It does not extend.gitleaks-estate.toml, so the path entry that exempts the baseline file is not in effect. In gitbot-fleet,.gitleaks.tomlstarts with[extend] path = ".gitleaks-estate.toml".check.shof the scanner, lines 27 to 49 and 82).Result 2: the governance bundle does not start (run 42874783871)
The run ends with
startup_failure. The annotation on the run page says (read through a web fetch, so 1 or 2 words can differ):hyperpolymath/standards/...is not found.metadatastician/standards/...is not allowed.State of
mainafter a mergescan / ...checks are new here. It is not known if the branch rules make them necessary for a merge.Changes
The 2 callers now name what the gitbot-fleet callers name:
.github/workflows/secret-scanner.yml:hyperpolymath/proven-cicd/.github/workflows/secret-scanner-reusable.ymlat03e858b, withfast-pr: false, nosecrets:line, andcontents: read..github/workflows/governance.yml:metadatastician/standards/.github/workflows/governance-reusable.ymlatea2f4d8, with the permissions of the gitbot-fleet caller.Triggers and concurrency do not change.
Not in this change
.gitleaks.toml(Result 1). Owner decision.actions.lockis not changed. It still records the old reference for these 2 workflows. The instructions of this repository say that the lock is not edited by hand, andgh actions-lockis not available in the session. A person runs the tool, or the owner permits a hand edit.codeql.yml,hypatia-scan.yml,mirror.yml,rust-ci.yml,scorecard.yml. On this head,codeql.yml,hypatia-scan.ymlandrust-ci.ymleach end withfailureat creation.mirror.ymlandscorecard.ymlwere not examined. They are not changed here: the owner asked for the 2 gates, and each of them needs the same setting change as the governance caller.Testing
yqreads the 2 files, and eachuses:value is the value of the gitbot-fleet caller.🤖 Generated with Claude Code
https://claude.ai/code/session_0136P7ZmiFSCoB3UR9Kk56rK