Skip to content

ci(gates): call the secret scanner and the governance bundle at the versions that gitbot-fleet calls #201

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
hyperpolymath merged 2 commits into from
Nov 10, 2026
+27 −9
Merged

ci(gates): call the secret scanner and the governance bundle at the versions that gitbot-fleet calls #201

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
7641807
ci(gates): call the secret scanner and the governance bundle at the v…
claude Nov 10, 2026
773b852
Merge branch 'main' into claude/current-estate-gates
hyperpolymath Nov 10, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 12 additions & 1 deletion .github/workflows/governance.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,13 @@
# This workflow is managed by gh actions-lock.
# SPDX-License-Identifier: MPL-2.0
# This workflow is managed by gh actions-lock.
# Caller of the estate governance bundle in metadatastician/standards, at the
# version that gitbot-fleet calls. gitbot-fleet has a pinned copy of this
# crate (bots/echidnabot/), so a line that fails a governance gate there
# (for example UUID conformance) must fail here first.
#
# The earlier caller named hyperpolymath/standards at 740c9d7. It did not
# start: each run ended at creation, with no job and no check.
name: Governance

on:
Expand All @@ -16,4 +23,8 @@ permissions:

jobs:
governance:
uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@740c9d7d4ed4d1f319a04c92b28218beb75668d7
uses: metadatastician/standards/.github/workflows/governance-reusable.yml@ea2f4d8a886585ed442687ae63d4ad7493379ba4
permissions:
actions: read
contents: read
security-events: write
23 changes: 15 additions & 8 deletions .github/workflows/secret-scanner.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,13 +1,18 @@
# This workflow is managed by gh actions-lock.
# SPDX-License-Identifier: MPL-2.0
# This workflow is managed by gh actions-lock.
# Thin wrapper around hyperpolymath/standards secret-scanner-reusable.yml.
# Matches the echidna sibling-repo pattern. The reusable contains the
# canonical trufflehog + gitleaks + rust-secrets (+ shell-secrets)
# bundle; routing through it force-promotes the post-Cloudflare-leak
# shell-secrets guardrail (currently MISSING in this repo's bespoke
# version) on the next sweep — direct security upgrade as a side
# effect of the structural change.
# Caller of the estate secret scanner in hyperpolymath/proven-cicd, at the
# version that gitbot-fleet calls. gitbot-fleet has a pinned copy of this
# crate (bots/echidnabot/), so a line that fails the scan there must fail
# here first.
#
# The earlier caller named hyperpolymath/standards at 740c9d7. It did not
# start: each run ended at creation, with no job and no check.
#
# Boundaries, as in the gitbot-fleet caller:
# * `fast-pr` is false: each run scans the full history.
# * No `secrets:` line. The callee declares no workflow_call secret.
# * `contents: read` is the whole grant.
name: Secret Scanner
on:
pull_request:
Expand All @@ -25,4 +30,6 @@ jobs:
scan:
permissions:
contents: read
uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@740c9d7d4ed4d1f319a04c92b28218beb75668d7 # main as of 2026-06-01
uses: hyperpolymath/proven-cicd/.github/workflows/secret-scanner-reusable.yml@03e858b6015e67cc1f9bc31ac1e29ddc1b6fd409
with:
fast-pr: false
Loading