Repository navigation
feat(scripts): 3 template-drift recipes (SPDX lint rule, SonarQube token guard, split comment keys) #2022
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # SPDX-License-Identifier: MPL-2.0 | |
| # This workflow is managed by gh actions-lock. | |
| name: Secret Scanner | |
| # Consumer migration to the published cicd-suite scanner. The three contexts | |
| # this repository's rulesets require — scan / gitleaks, scan / rust-secrets, | |
| # scan / shell-secrets — are produced by the callee's gitleaks job and by its | |
| # supplemental-results matrix; none is renamed, added or dropped here. | |
| # | |
| # Migration boundaries: | |
| # * `fast-pr` stays false: non-PR runs scan full history, and introduced-commit | |
| # PR scanning is not enabled before the security owner accepts it. | |
| # * No `secrets:` line. The callee declares no workflow_call secret and the | |
| # scanner installs its own checksum-pinned binary, so `secrets: inherit` | |
| # would forward every repository and organisation secret for no benefit. | |
| # * `contents: read` is the whole grant; the previous caller's | |
| # security-events / pull-requests / actions grants are not carried over. | |
| # * Triggers are unchanged: pull_request and push to main, nothing else. | |
| on: | |
| pull_request: | |
| push: | |
| branches: [main] | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| jobs: | |
| scan: | |
| # This job-level block REPLACES the workflow-level one. `contents: read` is | |
| # the complete grant the callee's jobs declare; granting more is needless | |
| # authority, granting less rejects the run at startup with zero jobs. | |
| permissions: | |
| contents: read | |
| uses: hyperpolymath/proven-cicd/.github/workflows/secret-scanner-reusable.yml@03e858b6015e67cc1f9bc31ac1e29ddc1b6fd409 | |
| with: | |
| # The old-pin canary does not attest this new pin. Introduced-commit | |
| # PR coverage is not approved; every run still scans full history. | |
| fast-pr: false | |
| # Deliberately no `secrets:` line — see the boundary note above. |