Repository navigation
fix(ci): call the secret scanner from proven-cicd-and-workflows - #176
Conversation
The caller used metadatastician/standards, which this repository's Actions settings do not allow, so every run failed at startup with zero jobs and the scan / gitleaks context was never reported. Call the published cicd-suite scanner at the pin gitbot-fleet and contractiles use (1fd5e63), with fast-pr false, contents: read only, and no `secrets: inherit`. actions.lock is left as it is: regenerating it here would also prune the reusable-workflow entries of other workflows. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0136P7ZnmBahbhfkFEP6ark4
|
Caution Review failedThe pull request is closed. Summary
Merge Risk:
 |
|
Codex Review Summary: ❌ FailedThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
This security review couldn’t start because the paying account has exhausted its Codex allowance and has insufficient available credits. The payer can check their balance and add credits in the Codex usage dashboard, then try again. If you do not manage the paying account, contact this repository's admins. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: df36f39f6e
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| security-events: write | ||
| contents: read | ||
| uses: metadatastician/standards/.github/workflows/secret-scanner-reusable.yml@a797d308c0517d4e2d21cc7f1cb08d41f82b1a12 | ||
| uses: hyperpolymath/proven-cicd-and-workflows/.github/workflows/secret-scanner-reusable.yml@1fd5e6371a50f0fc3687206a5adca0cdf7b39aa6 |
There was a problem hiding this comment.
For this repository's sha_pinning_required setup, this workflow remains marked as managed by gh actions-lock, but .github/workflows/actions.lock:46-47 still records the old metadatastician/standards dependency for this path rather than the new caller. That workflow/lock mismatch is rejected as an invalid lockfile during Actions startup, so PR and push runs can still produce zero jobs instead of the required scan / gitleaks check. Remove this workflow's managed marker and stale lock entry, as already done for the other deliberately de-onboarded cross-repository caller.
Useful? React with 👍 / 👎.
Why
secret-scanner.ymlcalledmetadatastician/standards/.github/workflows/secret-scanner-reusable.yml. This repository's Actions settings do not allow reusable workflows from that owner, so every run failed at startup with 0 jobs.scan / gitleakswas never reported, and each push sent a "Run failed" email.What
The caller now uses the published cicd-suite scanner owned by hyperpolymath, at the pin that gitbot-fleet and contractiles (hyperpolymath/contractiles#75) use:
hyperpolymath/proven-cicd-and-workflows/.github/workflows/secret-scanner-reusable.yml@1fd5e6371a50f0fc3687206a5adca0cdf7b39aa6fast-pr: false,contents: readonly, and nosecrets: inherit.actions.lockis unchanged.gh actions-lockwould also prune the reusable-workflow entries of other workflows here, so it was not run.Testing
In contractiles the same caller reported
scan / gitleaks,scan / rust-secretsandscan / shell-secretsas success on its PR and onmain. This PR's own run is the test here.Generated by Claude Code