[hyperpolymath]

Problem (observed)

VCL-UT's Secret Scanner workflow is not slow in recent PRs; it fails before its first job starts. For example run 40966408150 completed immediately with jobCount: 0, leaving no Gitleaks scan result. The wrapper still calls hyperpolymath/standards at an obsolete reusable pin and passes all secrets to a reusable that declares no secrets. A zero-job failure is never a successful security check.

Change (one workflow file)

• Call the current canonical metadatastician/standards/.github/workflows/secret-scanner-reusable.yml at verified immutable commit 8e48b1caade08a552646adeab66558ac43b4360d.
• Remove unnecessary secrets: inherit, actions: read and security-events: write; keep the required contents: read under the called job, matching the reusable's explicit permission contract.
• Preserve push/PR triggers, concurrency, Gitleaks, Rust secrets and shell secrets; no gates are disabled.
• The live hyperpolymath/vcl-ut selected-actions policy was separately repaired to permit the narrowly scoped canonical reusable while retaining SHA pinning.

Evidence

actionlint .github/workflows/secret-scanner.yml passes, git diff --check passes, and signed commit 569aa73 has good SSH signature.

CI should now show actual scan / gitleaks, scan / rust-secrets, and scan / shell-secrets jobs. Do not merge assuming the fix works solely because a zero-job run disappears; observe job-level execution.

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 58 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 920efe8b-8031-46ca-b9ea-79f92e0adc80

Commits

Reviewing files that changed from the base of the PR and between 034a057 and 569aa73.

Files selected for processing: 1

• .github/workflows/secret-scanner.yml

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-29T22:33:42.862660Z	569aa73	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[hyperpolymath]

Superseded by merged #133 (commit 591e6f3). The canonical pinned Secret Scanner change from this PR was cherry-picked, tested in the combined branch, and verified in main after the protected merge. Closing this separate PR to avoid duplicate changes; it was not independently merged.