From 569aa73d3e268eaf7fb854ad67e44149bd6c0ac2 Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Thu, 29 Oct 2026 22:32:09 +0000
Subject: [PATCH] fix(ci): call canonical pinned secret scanner with least
 privilege

---
 .github/workflows/secret-scanner.yml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml
index 63078c0..ad7e1f4 100644
--- a/.github/workflows/secret-scanner.yml
+++ b/.github/workflows/secret-scanner.yml
@@ -15,9 +15,9 @@ permissions:
 
 jobs:
   scan:
-    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@c65436ee3351cd6b0fa14b142938b195efc77586
-    secrets: inherit
+    # Canonical standards owner after transfer; exact reviewed commit pin.
+    # The reusable runs pinned local scanners with contents: read only and
+    # explicitly declares no workflow_call secrets. Do not inherit secrets.
+    uses: metadatastician/standards/.github/workflows/secret-scanner-reusable.yml@8e48b1caade08a552646adeab66558ac43b4360d
     permissions:
-      actions: read
       contents: read
-      security-events: write