Skip to content

fix(ci): call the secret scanner from proven-cicd-and-workflows #176

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
hyperpolymath merged 1 commit into from
Nov 10, 2026
+21 −5
Merged

fix(ci): call the secret scanner from proven-cicd-and-workflows #176

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
26 changes: 21 additions & 5 deletions .github/workflows/secret-scanner.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,23 @@
# This workflow is managed by gh actions-lock.
# SPDX-License-Identifier: MPL-2.0
# This workflow is managed by gh actions-lock.
name: Secret Scanner

# Calls the published cicd-suite scanner, as gitbot-fleet does. The context
# this repository's ruleset requires, scan / gitleaks, is produced by the
# callee's gitleaks job (its supplemental matrix also reports
# scan / rust-secrets and scan / shell-secrets).
#
# The previous caller called metadatastician/standards, which this
# repository's Actions settings do not allow, so every run failed at
# startup with zero jobs.
#
# Boundaries:
# * `fast-pr` stays false: every run scans full history.
# * No `secrets:` line. The callee declares no workflow_call secret and
# installs its own checksum-pinned binary, so `secrets: inherit` would
# forward every repository and organisation secret for no benefit.
# * `contents: read` is the whole grant the callee's jobs declare.

on:
pull_request:
push:
Expand All @@ -13,13 +28,14 @@ concurrency:
cancel-in-progress: true

permissions:
actions: read
contents: read

jobs:
scan:
# This job-level block REPLACES the workflow-level one. Granting less than
# the callee's jobs declare rejects the run at startup with zero jobs.
permissions:
actions: read
security-events: write
contents: read
uses: metadatastician/standards/.github/workflows/secret-scanner-reusable.yml@a797d308c0517d4e2d21cc7f1cb08d41f82b1a12
uses: hyperpolymath/proven-cicd-and-workflows/.github/workflows/secret-scanner-reusable.yml@1fd5e6371a50f0fc3687206a5adca0cdf7b39aa6

@chatgpt-codex-connector chatgpt-codex-connector Bot Nov 10, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge De-onboard the replacement caller from actions.lock

For this repository's sha_pinning_required setup, this workflow remains marked as managed by gh actions-lock, but .github/workflows/actions.lock:46-47 still records the old metadatastician/standards dependency for this path rather than the new caller. That workflow/lock mismatch is rejected as an invalid lockfile during Actions startup, so PR and push runs can still produce zero jobs instead of the required scan / gitleaks check. Remove this workflow's managed marker and stale lock entry, as already done for the other deliberately de-onboarded cross-repository caller.

Useful? React with 👍 / 👎.

with:
fast-pr: false
Loading