[hyperpolymath]

Summary

4 checks are red on main and on each pull request (for example #658 and #659): scan / gitleaks, scan / rust-secrets, and the 2 UUID conformance checks. This pull request repairs their 2 causes.

Cause	Lines	Where the source is
The Rust rule of the secret scan	2 names of environment variables in bots/echidnabot/src/api/auth.rs, 2 test values in bots/echidnabot/tests/smoke.rs	echidnabot
The same rule	1 test value in tests/echidnabot/api_gate_regressions.rs	this repository
The strict UUID rule	3 nil UUID literals in the echidnabot tests	echidnabot

The echidnabot lines are repaired at their source: hyperpolymath/echidnabot#197 (merged, 998d306). No line here is a secret. The values are names of environment variables and test credentials.

Changes

• bots/echidnabot/: scripts/sync-vendored-bot.sh echidnabot --sync --rev a045184... moves the pin from 1443adf to a045184, the head of upstream main. 4 files change in the copy:
  • src/api/auth.rs, tests/protocol_contract.rs, tests/smoke.rs: the changes of echidnabot#197 (the pragma on 4 lines; the nil UUID comes from uuid::Uuid::nil() and is not a literal).
  • Cargo.lock: the changes of echidnabot#198 (event-listener 5.4.2, chacha20 0.10.2, spin 0.9.9).
• tests/echidnabot/api_gate_regressions.rs: the pragma // scanner-allow: rust-secrets on the 1 test value that this repository owns, with a comment of 2 lines.

The 2 dated notes in docs/migrations/secret-scanner-cicd-suite/ name the old pin. They are records of 2026-11-09 and do not change.

Not in this change

The sqlx repair for RUSTSEC-2026-0459 (hyperpolymath/echidnabot#199) is not merged upstream at this time. A later pin move carries it.

Testing

• bash scripts/sync-vendored-bot.sh echidnabot --check: bots/echidnabot matches ...@a045184... (90 entries), exit 0.
• A local copy of the 2 rules (the Rust rule of the scanner at proven-cicd 03e858b, and the strict UUID rule), run on the whole tree: 0 hits in 270 Rust files. Before this change the same copy gave 5 lines and 3 literals.
• Not run locally: gitleaks, and the Rust tests of the copy. CI runs them. The 3 changed Rust files passed the echidnabot CI at 998d306.

What to expect in CI

scan / gitleaks, scan / rust-secrets and the 2 UUID conformance checks pass. If 1 of them does not, the result is added here.

---

Generated by Claude Code

[coderabbitai]

Caution

Review failed

The pull request is closed.

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[chatgpt-codex-connector]

Codex Review Summary: ❌ Failed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-10T18:54:58.869637Z	0cc6e8d	Draft marked ready
🔒 Security Review	❌ Failed 2026-11-10T18:52:41.823193Z We couldn’t complete this review. Comment @codex security review to try again.	0cc6e8d	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

This security review couldn’t start because the paying account has exhausted its Codex allowance and has insufficient available credits. The payer can check their balance and add credits in the Codex usage dashboard, then try again. If you do not manage the paying account, contact this repository's admins.