Repository navigation
fix(ci): call the secret scanner from proven-cicd-and-workflows - #205
Merged
Merged
Conversation
hyperpolymath/proven-cicd is being retired; its commits were merged into hyperpolymath/proven-cicd-and-workflows (proven-cicd-and-workflows#95). The pin moves from proven-cicd@03e858b to proven-cicd-and-workflows@ 1fd5e63 (the #94 merge). 03e858b is an ancestor of 1fd5e63, and the reusable workflow differs in one line only: its caller check also admits the new repository name, which this call needs. actions.lock is not changed. It is tool-owned, and its record for this file already names standards@740c9d7, not the proven-cicd pin. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0136P7ZmAsYpFA9gxfQLF3F6
Contributor
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 38 minutes. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. |
|
hyperpolymath
marked this pull request as ready for review
November 10, 2026 20:01
Codex Review Summary: ❌ FailedThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
6 of 9 tasks
hyperpolymath
added a commit
to hyperpolymath/anytype
that referenced
this pull request
Nov 10, 2026
## Summary The secret scan of this repository does not run. `secret-scanner.yml` calls a reusable workflow of the standards repository, and the Actions rule of this repository refuses a reusable workflow of a different owner. This PR points the caller at `hyperpolymath/proven-cicd-and-workflows` at `1fd5e63`. That is the commit that echidnabot (hyperpolymath/echidnabot#205) and gitbot-fleet call. The owner is the same as the owner of this repository, so the rule permits the call with no setting change. ## Changes - `secret-scanner.yml`: - `uses:` names `hyperpolymath/proven-cicd-and-workflows/.github/workflows/secret-scanner-reusable.yml@1fd5e6371a50f0fc3687206a5adca0cdf7b39aa6`. - The job id stays `scan`. The called workflow reads the caller file and refuses a different job id or a pin that is not a full SHA. - `fast-pr: false`: each run scans the full history. - The job grant becomes `contents: read` only. The called workflow requests nothing more. - The triggers and the `concurrency:` key do not change. The called workflow has no `concurrency:` key. - `README.adoc` (workflows): the lines on secret scanning name the new source. ## RSR Quality Checklist ### Required - [ ] Tests pass (`just test` or equivalent): not run, the change is 1 workflow file and 1 document - [ ] Code is formatted (`just fmt` or equivalent): not run, same reason - [ ] Linter is clean (no new warnings or errors): not run locally, the PR checks give the result - [x] No banned language patterns (no TypeScript, no npm/bun, no Go/Python) - [x] No `unsafe` blocks without `// SAFETY:` comments - [x] No banned functions (`believe_me`, `unsafeCoerce`, `Obj.magic`, `Admitted`, `sorry`) - [x] SPDX license headers present on all new/modified source files - [x] No secrets, credentials, or `.env` files included ### As Applicable - [x] Documentation updated: `.github/workflows/README.adoc` ## Testing - The `uses:` line matches the pattern that the called workflow applies to its caller (checked with the same regular expression). - `yq` parses the file. - Read at `1fd5e63`: the called workflow has the jobs `gitleaks`, `rust-secrets` and `shell-secrets`, declares no `workflow_call` secret, and requests `contents: read` only. - Static check before the run: this repository has 0 Rust files, and the 4 patterns of the shell-secrets rule match 0 lines in its 29 shell files. Not verified before the push: - The gitleaks result on the full history. The run on this pull request is the first evidence. A finding there is a finding in the history of this repository, not a fault of this change. --- _Generated by [Claude Code](https://claude.ai/code/session_0136P7ZmiFSCoB3UR9Kk56rK)_ Co-authored-by: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
hyperpolymath/proven-cicd is being retired. Its commits were merged into hyperpolymath/proven-cicd-and-workflows (proven-cicd-and-workflows#95). This PR moves the Secret Scanner call to the new repository before the owner deletes the old one.
hyperpolymath/proven-cicd/.github/workflows/secret-scanner-reusable.yml@03e858bhyperpolymath/proven-cicd-and-workflows/.github/workflows/secret-scanner-reusable.yml@1fd5e63(the merge of proven-cicd-and-workflows#94)03e858b is an ancestor of 1fd5e63. The reusable workflow differs in 1 line: the caller check also admits
proven-cicd-and-workflows. This call needs that line.Not changed
actions.lockis tool-owned. Its record forsecret-scanner.ymlalready namesstandards@740c9d7, not the proven-cicd pin, so this PR does not change its state.Follow-up for the owner
gitbot-fleet also calls proven-cicd@03e858b. It must move to the new repository before proven-cicd is deleted.
Generated by Claude Code