fix(ci): call the secret scanner from proven-cicd-and-workflows

.github/workflows/secret-scanner.yml

@@ -36,7 +36,7 @@ jobs:
     # authority, granting less rejects the run at startup with zero jobs.
     permissions:
       contents: read
-    uses: hyperpolymath/proven-cicd/.github/workflows/secret-scanner-reusable.yml@03e858b6015e67cc1f9bc31ac1e29ddc1b6fd409
+    uses: hyperpolymath/proven-cicd-and-workflows/.github/workflows/secret-scanner-reusable.yml@1fd5e6371a50f0fc3687206a5adca0cdf7b39aa6
     with:
       # The old-pin canary does not attest this new pin. Introduced-commit
       # PR coverage is not approved; every run still scans full history.

docs/migrations/secret-scanner-cicd-suite/fixtures/SHA256SUMS

@@ -1,3 +1,3 @@
 4745e9318346b1a3eae2e0bf65c6732f73d2ead78ef29de9e20659a71f8057d8  cicd-suite-4404c3c0474e17753fe7689f3485c02890aac113-secret-scanner-reusable.yml
 cba6cd207cb474563a7bc53bf31c72eaf1c42b4dcd3451d2cce0d8581949b5e8  historical-source.json
-bbe92a3a3e1e78bc145f9397ad073e7a5e783c323127e0c1c701facabbcc4379  restore-historical-source.sh
+bc601a927657f973d96f228590d667bad93b73d9b42d132419d98ca792b6f5c8  restore-historical-source.sh

docs/migrations/secret-scanner-cicd-suite/fixtures/restore-historical-source.sh

@@ -8,7 +8,7 @@ manifest="$tree/scripts/lib/pinned-reusable-sources.json"
 workflow="$tree/.github/workflows/secret-scanner.yml"
 receipts="$tree/scripts/lib/lock-closure-receipts.tsv"
 old='hyperpolymath/cicd-suite/.github/workflows/secret-scanner-reusable.yml@4404c3c0474e17753fe7689f3485c02890aac113'
-new='hyperpolymath/proven-cicd/.github/workflows/secret-scanner-reusable.yml@03e858b6015e67cc1f9bc31ac1e29ddc1b6fd409'
+new='hyperpolymath/proven-cicd-and-workflows/.github/workflows/secret-scanner-reusable.yml@1fd5e6371a50f0fc3687206a5adca0cdf7b39aa6'
 # Refuse anything other than the known deployed successor; do not silently
 # reinterpret a later caller or a damaged source catalog as this old plan.
 OLD_CALL="$old" NEW_CALL="$new" python3 - "$workflow" <<'PY'
@@ -22,15 +22,15 @@ if s.count(new) != 1 or old in s:
     raise SystemExit('historical projection: unexpected scanner caller')
 p.write_text(s.replace(new, old))
 PY
-jq -e '[.sources[] | select(.repository=="hyperpolymath/proven-cicd" and .commit=="03e858b6015e67cc1f9bc31ac1e29ddc1b6fd409" and .role=="active")] | length == 1' "$manifest" >/dev/null
+jq -e '[.sources[] | select(.repository=="hyperpolymath/proven-cicd-and-workflows" and .commit=="1fd5e6371a50f0fc3687206a5adca0cdf7b39aa6" and .role=="active")] | length == 1' "$manifest" >/dev/null
 jq --slurpfile prior "$fixture" '
-  .sources |= (map(select(.repository != "hyperpolymath/proven-cicd" or .commit != "03e858b6015e67cc1f9bc31ac1e29ddc1b6fd409")) + [$prior[0].source]) |
-  del(.dependencies["hyperpolymath/proven-cicd@03e858b6015e67cc1f9bc31ac1e29ddc1b6fd409"]) |
+  .sources |= (map(select(.repository != "hyperpolymath/proven-cicd-and-workflows" or .commit != "1fd5e6371a50f0fc3687206a5adca0cdf7b39aa6")) + [$prior[0].source]) |
+  del(.dependencies["hyperpolymath/proven-cicd-and-workflows@1fd5e6371a50f0fc3687206a5adca0cdf7b39aa6"]) |
   .dependencies["hyperpolymath/cicd-suite@4404c3c0474e17753fe7689f3485c02890aac113"] = $prior[0].dependency
 ' "$manifest" > "$manifest.tmp"
 mv "$manifest.tmp" "$manifest"
 # The archived proposal has its own source receipt; keep unrelated receipts.
-awk '$0 !~ /^# Reviewed source: hyperpolymath\/proven-cicd\// && $0 !~ /^hyperpolymath\/proven-cicd\t/' "$receipts" > "$receipts.tmp"
+awk '$0 !~ /^# Reviewed source: hyperpolymath\/proven-cicd-and-workflows\// && $0 !~ /^hyperpolymath\/proven-cicd-and-workflows\t/' "$receipts" > "$receipts.tmp"
 printf '%s\n' '# Reviewed historical cicd-suite scanner source' >> "$receipts.tmp"
 printf 'hyperpolymath/cicd-suite\t4404c3c0474e17753fe7689f3485c02890aac113\tactions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1\n' >> "$receipts.tmp"
 mv "$receipts.tmp" "$receipts"

docs/migrations/secret-scanner-cicd-suite/preflight.sh

@@ -87,7 +87,7 @@ fi
 # this disposable tree. This preserves the historical canary gate without
 # pretending it verifies the newer deployed caller; E2E separately authenticates
 # the live source and tests its scanner contract.
-if grep -Fq 'uses: hyperpolymath/proven-cicd/.github/workflows/secret-scanner-reusable.yml@03e858b6015e67cc1f9bc31ac1e29ddc1b6fd409' "$TMP/tree/.github/workflows/secret-scanner.yml" 2>/dev/null; then
+if grep -Fq 'uses: hyperpolymath/proven-cicd-and-workflows/.github/workflows/secret-scanner-reusable.yml@1fd5e6371a50f0fc3687206a5adca0cdf7b39aa6' "$TMP/tree/.github/workflows/secret-scanner.yml" 2>/dev/null; then
   if ! bash "$MIG/fixtures/restore-historical-source.sh" "$TMP/tree" "$MIG/fixtures/historical-source.json"; then
     finding TREE "could not reconstruct the historical scanner proposal"
   fi

scripts/check-scanner-caller.rb

@@ -4,7 +4,7 @@
 require 'psych'
 
 path = ARGV.fetch(0, '.github/workflows/secret-scanner.yml')
-expected = 'hyperpolymath/proven-cicd/.github/workflows/secret-scanner-reusable.yml@03e858b6015e67cc1f9bc31ac1e29ddc1b6fd409'
+expected = 'hyperpolymath/proven-cicd-and-workflows/.github/workflows/secret-scanner-reusable.yml@1fd5e6371a50f0fc3687206a5adca0cdf7b39aa6'
 
 # Validate a Psych node and its descendants before loading the workflow.
 # Raises RuntimeError for aliases, non-scalar mapping keys, or duplicate keys

scripts/lib/lock-closure-receipts.tsv

@@ -61,5 +61,5 @@ metadatastician/standards	ea2f4d8a886585ed442687ae63d4ad7493379ba4	editorconfig-
 metadatastician/standards	ea2f4d8a886585ed442687ae63d4ad7493379ba4	erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124
 metadatastician/standards	ea2f4d8a886585ed442687ae63d4ad7493379ba4	oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6
 
-# Reviewed source: hyperpolymath/proven-cicd/.github/workflows/secret-scanner-reusable.yml@03e858b6015e67cc1f9bc31ac1e29ddc1b6fd409
-hyperpolymath/proven-cicd	03e858b6015e67cc1f9bc31ac1e29ddc1b6fd409	actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+# Reviewed source: hyperpolymath/proven-cicd-and-workflows/.github/workflows/secret-scanner-reusable.yml@1fd5e6371a50f0fc3687206a5adca0cdf7b39aa6
+hyperpolymath/proven-cicd-and-workflows	1fd5e6371a50f0fc3687206a5adca0cdf7b39aa6	actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1

scripts/lib/pinned-reusable-sources.json

@@ -699,11 +699,11 @@
       "local_file": "C:\\Users\\sudoodle\\OneDrive\\Documents\\ChatGPT\\TYPE THEORY\\echo-reader-compat-20261106\\closure-cycle-20261107\\sources\\metadatastician\\standards\\75bd5994470661a099df562d6d5ad2fe744dbd66\\.github\\workflows\\secret-scanner-reusable.yml"
     },
     {
-      "repository": "hyperpolymath/proven-cicd",
-      "commit": "03e858b6015e67cc1f9bc31ac1e29ddc1b6fd409",
+      "repository": "hyperpolymath/proven-cicd-and-workflows",
+      "commit": "1fd5e6371a50f0fc3687206a5adca0cdf7b39aa6",
       "path": ".github/workflows/secret-scanner-reusable.yml",
-      "blob": "b75b630ab6bee9943573502f0ace580078ef92ae",
-      "content_sha256": "02e34046c20f25c6b1e9ada99bd46294e33cc90a792fefa427f09aef098dcad9",
+      "blob": "3ac563a8da07619459d190a2e75d1742216a9818",
+      "content_sha256": "21ae8d1ba45cf078106fcce5314f68635e17f6636991b8466f1c2a5e1d6e9cbf",
       "role": "active",
       "callers": [
         {
@@ -724,7 +724,7 @@
           "line": 55
         }
       ],
-      "source_url": "https://github.com/hyperpolymath/proven-cicd/blob/03e858b6015e67cc1f9bc31ac1e29ddc1b6fd409/.github/workflows/secret-scanner-reusable.yml"
+      "source_url": "https://github.com/hyperpolymath/proven-cicd-and-workflows/blob/1fd5e6371a50f0fc3687206a5adca0cdf7b39aa6/.github/workflows/secret-scanner-reusable.yml"
     }
   ],
   "dependencies": {
@@ -833,11 +833,11 @@
       "owner_id": 44036562,
       "repo_id": 192625955
     },
-    "hyperpolymath/proven-cicd@03e858b6015e67cc1f9bc31ac1e29ddc1b6fd409": {
-      "ref": "03e858b6015e67cc1f9bc31ac1e29ddc1b6fd409",
-      "commit": "sha1-03e858b6015e67cc1f9bc31ac1e29ddc1b6fd409",
+    "hyperpolymath/proven-cicd-and-workflows@1fd5e6371a50f0fc3687206a5adca0cdf7b39aa6": {
+      "ref": "1fd5e6371a50f0fc3687206a5adca0cdf7b39aa6",
+      "commit": "sha1-1fd5e6371a50f0fc3687206a5adca0cdf7b39aa6",
       "owner_id": 6759885,
-      "repo_id": 1446155688,
+      "repo_id": 1326697643,
       "uses": [
         "actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1"
       ]

scripts/tests/pinned-source-entrypoints-test.sh

@@ -24,7 +24,7 @@ cp "$ROOT/$MIG/preflight.sh" "$ROOT/$MIG/required-contexts.txt" "$BASE/$MIG/"
 cp -R "$ROOT/$MIG/fixtures" "$ROOT/$MIG/patches" "$BASE/$MIG/"
 # Exercise the original migration proposal, not the newer live caller.
 # Its archived source and receipt are reconstructed only in this fixture.
-if grep -Fq 'uses: hyperpolymath/proven-cicd/.github/workflows/secret-scanner-reusable.yml@03e858b6015e67cc1f9bc31ac1e29ddc1b6fd409' "$BASE/.github/workflows/secret-scanner.yml"; then
+if grep -Fq 'uses: hyperpolymath/proven-cicd-and-workflows/.github/workflows/secret-scanner-reusable.yml@1fd5e6371a50f0fc3687206a5adca0cdf7b39aa6' "$BASE/.github/workflows/secret-scanner.yml"; then
   bash "$BASE/$MIG/fixtures/restore-historical-source.sh" "$BASE" "$BASE/$MIG/fixtures/historical-source.json"
 fi
 # Deliberately omit the canary directory. Every invocation binds --receipt to

scripts/tests/scanner-caller-contract-test.sh

@@ -19,7 +19,7 @@ reject() {
 sed -i 's/fast-pr: false/fast-pr: true/' "$wf"; reject 'fast PR scanning'
 printf '    secrets: inherit\n' >> "$wf"; reject 'inherited secrets'
 sed -i 's/contents: read/contents: write/' "$wf"; reject 'excess permissions'
-sed -i 's/03e858b6015e67cc1f9bc31ac1e29ddc1b6fd409/main/' "$wf"; reject 'mutable suite ref'
+sed -i 's/1fd5e6371a50f0fc3687206a5adca0cdf7b39aa6/main/' "$wf"; reject 'mutable suite ref'
 printf '\n  scan:\n    uses: bad/repo/.github/workflows/bad.yml@main\n' >> "$wf"; reject 'duplicate job'
 echo 'scanner caller negative controls passed'
 

tools/workflow-lock-audit/tests/contracts.rs

@@ -367,19 +367,19 @@ fn scanner_source_pin_and_supported_lock_scope() {
     let lock: Value =
         parse_yaml(&fs::read_to_string(repo().join(".github/workflows/actions.lock")).unwrap())
             .unwrap();
-    let pin = "03e858b6015e67cc1f9bc31ac1e29ddc1b6fd409";
+    let pin = "1fd5e6371a50f0fc3687206a5adca0cdf7b39aa6";
     assert_eq!(
         workflow["jobs"]["scan"]["uses"],
         text(&format!(
-            "hyperpolymath/proven-cicd/.github/workflows/secret-scanner-reusable.yml@{pin}"
+            "hyperpolymath/proven-cicd-and-workflows/.github/workflows/secret-scanner-reusable.yml@{pin}"
         ))
     );
     assert_eq!(
         lock["workflows"][".github/workflows/secret-scanner.yml"],
         value("[]")
     );
     assert!(lock["dependencies"]
-        .get(format!("hyperpolymath/proven-cicd@{pin}"))
+        .get(format!("hyperpolymath/proven-cicd-and-workflows@{pin}"))
         .is_none());
     // Job-level reusables are outside the supported lock generator's scope.
     // Require a separately source-verified active root for this exact caller.
@@ -392,7 +392,7 @@ fn scanner_source_pin_and_supported_lock_scope() {
         .unwrap()
         .iter()
         .filter(|source| {
-            source["repository"] == "hyperpolymath/proven-cicd"
+            source["repository"] == "hyperpolymath/proven-cicd-and-workflows"
                 && source["commit"] == pin
                 && source["role"] == "active"
                 && source["callers"].as_array().unwrap().iter().any(|caller| {