From 7641807c1e8c3ebae65a8a33d0fb06e747c03152 Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 10 Nov 2026 18:23:33 +0000 Subject: [PATCH] ci(gates): call the secret scanner and the governance bundle at the versions that gitbot-fleet calls The 2 callers named hyperpolymath/standards at 740c9d7 (June). They do not start: each run ends at creation with no job and no check (481 runs of `secret-scanner.yml`, 410 runs of `governance.yml`). So this repository has no secret scan and no governance gate at this time. gitbot-fleet has a pinned copy of this crate and calls current gates. 4 of its checks went red on lines that come from here, and this repository did not see them first. The 2 callers now name what gitbot-fleet names: - `secret-scanner.yml`: hyperpolymath/proven-cicd `secret-scanner-reusable.yml` at 03e858b, `fast-pr: false`, no `secrets:` line, `contents: read`. - `governance.yml`: metadatastician/standards `governance-reusable.yml` at ea2f4d8, with the permissions of the gitbot-fleet caller. `actions.lock` is not changed. It still records the old reference for these 2 workflows. The lock is owned by `gh actions-lock`, which is not available in this session. Co-Authored-By: Claude Claude-Session: https://claude.ai/code/session_0136P7ZmiFSCoB3UR9Kk56rK --- .github/workflows/governance.yml | 13 ++++++++++++- .github/workflows/secret-scanner.yml | 23 +++++++++++++++-------- 2 files changed, 27 insertions(+), 9 deletions(-) diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index 5bca36a..d8abfd6 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -1,6 +1,13 @@ # This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. +# Caller of the estate governance bundle in metadatastician/standards, at the +# version that gitbot-fleet calls. gitbot-fleet has a pinned copy of this +# crate (bots/echidnabot/), so a line that fails a governance gate there +# (for example UUID conformance) must fail here first. +# +# The earlier caller named hyperpolymath/standards at 740c9d7. It did not +# start: each run ended at creation, with no job and no check. name: Governance on: @@ -16,4 +23,8 @@ permissions: jobs: governance: - uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@740c9d7d4ed4d1f319a04c92b28218beb75668d7 + uses: metadatastician/standards/.github/workflows/governance-reusable.yml@ea2f4d8a886585ed442687ae63d4ad7493379ba4 + permissions: + actions: read + contents: read + security-events: write diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index e1e065c..ad78af7 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -1,13 +1,18 @@ # This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. -# Thin wrapper around hyperpolymath/standards secret-scanner-reusable.yml. -# Matches the echidna sibling-repo pattern. The reusable contains the -# canonical trufflehog + gitleaks + rust-secrets (+ shell-secrets) -# bundle; routing through it force-promotes the post-Cloudflare-leak -# shell-secrets guardrail (currently MISSING in this repo's bespoke -# version) on the next sweep — direct security upgrade as a side -# effect of the structural change. +# Caller of the estate secret scanner in hyperpolymath/proven-cicd, at the +# version that gitbot-fleet calls. gitbot-fleet has a pinned copy of this +# crate (bots/echidnabot/), so a line that fails the scan there must fail +# here first. +# +# The earlier caller named hyperpolymath/standards at 740c9d7. It did not +# start: each run ended at creation, with no job and no check. +# +# Boundaries, as in the gitbot-fleet caller: +# * `fast-pr` is false: each run scans the full history. +# * No `secrets:` line. The callee declares no workflow_call secret. +# * `contents: read` is the whole grant. name: Secret Scanner on: pull_request: @@ -25,4 +30,6 @@ jobs: scan: permissions: contents: read - uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@740c9d7d4ed4d1f319a04c92b28218beb75668d7 # main as of 2026-06-01 + uses: hyperpolymath/proven-cicd/.github/workflows/secret-scanner-reusable.yml@03e858b6015e67cc1f9bc31ac1e29ddc1b6fd409 + with: + fast-pr: false