fix(security): the weekly secret scan has been scanning zero commits

[ChelseaKR]

Two bugs, one masking the other

1. The scan never ran. Every scheduled run of secret-scan-scheduled has failed since the workflow was added. Not on a finding: on the action's own guard.

::error::BASE and HEAD commits are the same. TruffleHog won't scan anything.
Process completed with exit code 1.

No chunk count, no verified_secrets line, nothing. With path, base and head all unset, the action resolves base and head to the same commit and refuses. The comment in this file asserted the opposite ("on schedule/workflow_dispatch the action scans the whole repository history"), and that assumption is the bug.

path: ./ makes it a real whole-repository scan. Confirmed locally against the same pinned v3.96.0 image: 4,875 chunks, 7 MB of history.

2. What the first real scan found: 37 verified secrets, all false.

Detector	Count	Example match
Lob	37	test_any_single_byte_change_fails_closed in tests/test_property_invariants.py

A Lob API key is test_ or live_ followed by alphanumerics, which is also the shape of every pytest function name in tests/. They report as verified because Lob's verification endpoint cannot distinguish a malformed key from an unauthorized one. There is no Lob integration in this repo.

Excluded by detector rather than by path: skipping tests/ would blind the scan to real secrets in fixtures, which is where they most often get committed by accident. Every other detector still runs over the whole tree, tests included.

Result

$ trufflehog git file://. --results=verified --exclude-detectors=Lob
finished scanning  {"chunks": 4875, "verified_secrets": 0, "unverified_secrets": 0}

Note

This is not unique to this repo. The same "scanned nothing" failure is live in swelter and transit-delivery-atlas, and the same Lob false positive is live in id-churn-sentinel (5) and women-artist-discovery (19). It was fixed in ctdl-validate earlier today.

[ChelseaKR]

Follow-up commit: the first dispatch that cleared the BASE==HEAD guard died on flag 'no-update' cannot be repeated. The action's own command is git file:///tmp/ --since-commit '' --branch '' --fail --no-update, so both flags were already there. Dropped from extra_args.

Verified on the runner, dispatched on this branch:

"chunks": 4879, "bytes": 7011660, "verified_secrets": 0, "unverified_secrets": 0

7 MB of history actually scanned, where every previous run scanned zero.