Repository navigation
fix(ci): call the secret scanner from proven-cicd-and-workflows - #663
Merged
Merged
Conversation
hyperpolymath/proven-cicd is being retired; its commits were merged into hyperpolymath/proven-cicd-and-workflows (proven-cicd-and-workflows#95). The fleet scanner moves from proven-cicd@03e858b to proven-cicd-and-workflows@1fd5e63 (the #94 merge). 03e858b is an ancestor of 1fd5e63. The reusable differs in one line: its caller check also admits the new repository name, which this call needs. Its steps (actions/checkout@3d3c42e at lines 28 and 55) are unchanged. The pin is bound in several places, and each moves with it: - scripts/check-scanner-caller.rb and its contract test (expected pin); - scripts/lib/pinned-reusable-sources.json: the active source (blob 3ac563a, content sha256 21ae8d1b...) and its dependency record (repo_id 1326697643, the id of proven-cicd-and-workflows); - scripts/lib/lock-closure-receipts.tsv: the reviewed receipt; - tools/workflow-lock-audit/tests/contracts.rs; - the historical-projection fixture, the preflight and the entrypoint test, which recognise the live caller before they restore the archived 4404c3c proposal; fixtures/SHA256SUMS is updated for the fixture. The full-history policy, permissions, secrets boundary and required contexts are unchanged. Dated migration records are not rewritten. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0136P7ZmAsYpFA9gxfQLF3F6
Contributor
|
Caution Review failedThe pull request is closed.
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. |
|
hyperpolymath
marked this pull request as ready for review
November 10, 2026 20:31
Codex Review Summary: ❌ FailedThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
This security review couldn’t start because the paying account has exhausted its Codex allowance and has insufficient available credits. The payer can check their balance and add credits in the Codex usage dashboard, then try again. If you do not manage the paying account, contact this repository's admins. |
hyperpolymath
added a commit
to hyperpolymath/contractiles
that referenced
this pull request
Nov 10, 2026
## Why The `main` ruleset requires the `scan / gitleaks` status check. `secret-scanner.yml` called `hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@571cc73`, and every run of it failed at startup with 0 jobs (for example run 42703228097 on #74, and run 42499662578 on `main`). So the required context was never reported, and no PR could merge without a bypass. This blocks #74. ## What `.github/workflows/secret-scanner.yml` now calls the published cicd-suite scanner, as gitbot-fleet does since hyperpolymath/gitbot-fleet#663: - `uses: hyperpolymath/proven-cicd-and-workflows@1fd5e63`, the same pin as gitbot-fleet. - `fast-pr: false`, so every run scans full history. - `contents: read` is the only grant, which is exactly what the callee's jobs declare. - No `secrets: inherit`. The callee declares no `workflow_call` secret and installs its own checksum-pinned Gitleaks. The callee's `gitleaks` job produces `scan / gitleaks`. Its supplemental matrix also reports `scan / rust-secrets` and `scan / shell-secrets`. `actions.lock` is unchanged. Its entry for this workflow is already `[]`, as gitbot-fleet's is for the same caller. ## Testing - The `uses:` line parses (yq). `actionlint` is not installed in this session. - This PR's own CI run is the test: it must report `scan / gitleaks`. --- _Generated by [Claude Code](https://claude.ai/code/session_0136P7ZnmBahbhfkFEP6ark4)_ Co-authored-by: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
hyperpolymath/proven-cicd is being retired. Its commits were merged into hyperpolymath/proven-cicd-and-workflows (proven-cicd-and-workflows#95). gitbot-fleet is the last caller. This PR moves the fleet secret scanner so the old repository can be deleted.
hyperpolymath/proven-cicd/.github/workflows/secret-scanner-reusable.yml@03e858bhyperpolymath/proven-cicd-and-workflows/.github/workflows/secret-scanner-reusable.yml@1fd5e63(the merge of proven-cicd-and-workflows#94)03e858b is an ancestor of 1fd5e63. The reusable differs in 1 line: its caller check also admits the new repository name, which this call needs. Its steps are unchanged (
actions/checkout@3d3c42eat lines 28 and 55).What moves with the pin
The pin is bound in several places. Each one moves, following the pattern of #656:
.github/workflows/secret-scanner.ymluses:linescripts/check-scanner-caller.rb,scripts/tests/scanner-caller-contract-test.shscripts/lib/pinned-reusable-sources.json3ac563a, content sha25621ae8d1b…) and its dependency record (repo_id1326697643, the id of proven-cicd-and-workflows)scripts/lib/lock-closure-receipts.tsvtools/workflow-lock-audit/tests/contracts.rspreflight.sh,fixtures/restore-historical-source.sh,scripts/tests/pinned-source-entrypoints-test.shfixtures/SHA256SUMSUnchanged: full-history policy (
fast-pr: false), permissions, secrets boundary, triggers and required contexts. Dated migration records (for example2026-11-09-repair-notes.md) are not rewritten.Local evidence
ruby scripts/check-scanner-caller.rbandscripts/tests/scanner-caller-contract-test.sh: pass, including every negative control.scripts/audit-pinned-reusable-sources.sh --fetch-sources: findings=0, not-run=0, verified-roots=5. It fetched 1fd5e63 from proven-cicd-and-workflows and authenticated the blob.scripts/audit-lock-closure.sh: fatal=0, review=0.cargo test --lockedintools/workflow-lock-audit: 42 passed.scripts/tests/pinned-source-entrypoints-test.sh: 7 passed, 2 failed ("untouched candidate remains blocked by missing canary", "untouched diagnostic classification", both exit 3). The same 2 fail with identical output on unchangedmain(117e3e8), so this change does not cause them.The old-pin canary does not attest this new pin, as the caller comment already says.
Generated by Claude Code