Skip to content

ci(secret-scan): canonical estate scanner caller, key scan (D243) - #50

Merged
hyperpolymath merged 2 commits into
mainfrom
ci/secret-scan-floor-caller
Oct 1, 2026
Merged

ci(secret-scan): canonical estate scanner caller, key scan (D243)#50
hyperpolymath merged 2 commits into
mainfrom
ci/secret-scan-floor-caller

Conversation

@hyperpolymath

@hyperpolymath hyperpolymath commented Oct 1, 2026

Copy link
Copy Markdown
Owner

What

Write the canonical estate secret-scanner caller to .github/workflows/secret-scanner.yml so this repo emits scan / gitleaks, the context the estate Secret-Scan-Floor ruleset (D243/D244) requires. The previous inline scanner jobs emitted bare contexts (e.g. gitleaks) that cannot satisfy the floor; the reusable deliberately drops TruffleHog as redundant with gitleaks.

Job key scan; reusable hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@74d2f66f575246cf6e313ae7775f44df6e097ff2; push trigger on main. actionlint clean (previous file findings: 0). Commit via GraphQL createCommitOnBranch (GitHub-signed, valid: true).

🤖 Generated with Claude Code

https://claude.ai/code/session_0136eszqrQ53Kj7aBH1D4rXK

@hyperpolymath @claude
ci(secret-scan): canonical estate scanner caller, key scan (D243)
5cafff0 
Secret-Scan-Floor (D243/D244) requires the context `scan / gitleaks` estate-wide. The previous inline scanner jobs emitted bare contexts (e.g. `gitleaks`) that cannot satisfy the floor; the reusable deliberately drops TruffleHog as redundant with gitleaks. Write the canonical caller: job key `scan`, reusable pinned to standards@74d2f66, push trigger on the default branch `main`.

actionlint: new file clean (findings in previous file: 0).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0136eszqrQ53Kj7aBH1D4rXK
@coderabbitai

coderabbitai Bot commented Oct 1, 2026 •
edited
Loading

Copy link
Copy Markdown

Review in Change Stack →

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (1)
  • .github/workflows/actions.lock is excluded by !**/*.lock

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 3611956c-cf92-4a12-bf30-7f261d800d5b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 902b5c63-6e58-4a7d-aa86-df46c3424a5e

📥 Commits

Reviewing files that changed from the base of the PR and between bf404d4 and 5cafff0.

📒 Files selected for processing (1)
  • .github/workflows/secret-scanner.yml

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details
⏰ Context from checks skipped due to timeout. (20)
  • GitHub Check: governance / Licence consistency
  • GitHub Check: governance / Exemption ratchet
  • GitHub Check: governance / Check Workflow Staleness
  • GitHub Check: governance / Workflow security linter
  • GitHub Check: governance / Code quality + docs
  • GitHub Check: governance / Trusted-base reduction policy
  • GitHub Check: governance / Security policy checks
  • GitHub Check: governance / Allowlist Preflight
  • GitHub Check: governance / Actions lockfile verify
  • GitHub Check: governance / Debt ratchet
  • GitHub Check: governance / Live Actions policy (credentialed advisory)
  • GitHub Check: governance / Language / package anti-pattern policy
  • GitHub Check: governance / Guix packaging policy (Nix retired)
  • GitHub Check: analyze (actions, none)
  • GitHub Check: Validate K9 contracts
  • GitHub Check: Validate DEED manifests
  • GitHub Check: Empty-linter (invisible characters)
  • GitHub Check: Hypatia Neurosymbolic Analysis
  • GitHub Check: estate-audit
  • GitHub Check: semgrep-cloud-platform/scan
⚠️ CI failures not shown inline (22)

GitHub Actions: Central Estate CI/CD Audit / 0_estate-audit.txt: ci(secret-scan): canonical estate scanner caller, key scan (D243)

Conclusion: failure

View job details

##[group]Run # Accepted placements widened per owner ruling 2026-09-19: estate
 �[36;1m# Accepted placements widened per owner ruling 2026-09-19: estate�[0m
 �[36;1m# repos legitimately keep governance docs under docs/ (and GitHub�[0m
 �[36;1m# renders under .github/) — rsr-template-repo itself was failing on�[0m
 �[36;1m# layout, not on substance. Root forms still win (first hit).�[0m
 �[36;1m# Template-repo mode: see below.�[0m
 �[36;1m#�[0m
 �[36;1m# Presence-only checking rewards filler. This gate previously demanded�[0m
 �[36;1m# ARCHITECTURE.md / MAINTAINERS.adoc / GOVERNANCE.md and checked only�[0m
 �[36;1m# that the paths existed — so the cheapest way to pass was to commit�[0m
 �[36;1m# template boilerplate. That happened: an estate repo acquired an�[0m
 �[36;1m# ARCHITECTURE.md describing a directory layout it does not have, a�[0m
 �[36;1m# MAINTAINERS naming a different account as owner, and a mise.toml�[0m
 �[36;1m# pinning `zig = "latest"` against that repo's own .tool-versions.�[0m
 �[36;1m# All three would have passed. So: presence, THEN format, THEN substance.�[0m
 �[36;1m#�[0m
 �[36;1m# Format policy (estate):�[0m
 �[36;1m#   .adoc  documentation (default)�[0m
 �[36;1m#   .md    wiki content only — plus a transitional allowance for the�[0m
 �[36;1m#          GitHub-mandated files, which are migrating to berrywiki format�[0m
 �[36;1m#   .txt   licence texts�[0m
 �[36;1m#   fixed  names GitHub or convention dictates (CODEOWNERS, funding.yml,�[0m
 �[36;1m#          NOTICE, AUTHORS, MAINTAINERS) keep their form�[0m
 �[36;1mset -uo pipefail�[0m
 �[36;1mfail=0�[0m
 �[36;1m�[0m
 �[36;1m# --- template-repo mode -------------------------------------------�[0m
 �[36;1m# An un-instantiated template legitimately SHIPS {{OWNER}}/{{AUTHOR}}�[0m
 �[36;1m# placeholders and self-references its own template name; judging it�[0m
 �[36;1m# like an instantiated repo is a category error. Detection is explicit�[0m
 �[36;1m# and auditable: the repo name says it is a temp...

GitHub Actions: Central Estate CI/CD Audit / estate-audit: ci(secret-scan): canonical estate scanner caller, key scan (D243)

Conclusion: failure

View job details

##[group]Run # Accepted placements widened per owner ruling 2026-09-19: estate
 �[36;1m# Accepted placements widened per owner ruling 2026-09-19: estate�[0m
 �[36;1m# repos legitimately keep governance docs under docs/ (and GitHub�[0m
 �[36;1m# renders under .github/) — rsr-template-repo itself was failing on�[0m
 �[36;1m# layout, not on substance. Root forms still win (first hit).�[0m
 �[36;1m# Template-repo mode: see below.�[0m
 �[36;1m#�[0m
 �[36;1m# Presence-only checking rewards filler. This gate previously demanded�[0m
 �[36;1m# ARCHITECTURE.md / MAINTAINERS.adoc / GOVERNANCE.md and checked only�[0m
 �[36;1m# that the paths existed — so the cheapest way to pass was to commit�[0m
 �[36;1m# template boilerplate. That happened: an estate repo acquired an�[0m
 �[36;1m# ARCHITECTURE.md describing a directory layout it does not have, a�[0m
 �[36;1m# MAINTAINERS naming a different account as owner, and a mise.toml�[0m
 �[36;1m# pinning `zig = "latest"` against that repo's own .tool-versions.�[0m
 �[36;1m# All three would have passed. So: presence, THEN format, THEN substance.�[0m
 �[36;1m#�[0m
 �[36;1m# Format policy (estate):�[0m
 �[36;1m#   .adoc  documentation (default)�[0m
 �[36;1m#   .md    wiki content only — plus a transitional allowance for the�[0m
 �[36;1m#          GitHub-mandated files, which are migrating to berrywiki format�[0m
 �[36;1m#   .txt   licence texts�[0m
 �[36;1m#   fixed  names GitHub or convention dictates (CODEOWNERS, funding.yml,�[0m
 �[36;1m#          NOTICE, AUTHORS, MAINTAINERS) keep their form�[0m
 �[36;1mset -uo pipefail�[0m
 �[36;1mfail=0�[0m
 �[36;1m�[0m
 �[36;1m# --- template-repo mode -------------------------------------------�[0m
 �[36;1m# An un-instantiated template legitimately SHIPS {{OWNER}}/{{AUTHOR}}�[0m
 �[36;1m# placeholders and self-references its own template name; judging it�[0m
 �[36;1m# like an instantiated repo is a category error. Detection is explicit�[0m
 �[36;1m# and auditable: the repo name says it is a temp...

GitHub Actions: Central Estate CI/CD Audit / estate-audit: ci(secret-scan): canonical estate scanner caller, key scan (D243)

Conclusion: failure

View job details

##[group]Run echo "Validating Idris2 ABI Purity..."
 �[36;1mecho "Validating Idris2 ABI Purity..."�[0m
 �[36;1mif [ -f "abi.ipkg" ]; then�[0m
 �[36;1m  # Check for forbidden side-effects in Abi.* modules�[0m
 �[36;1m  if git grep -E 'IO |unsafePerformIO|primIO' -- 'src/Abi*' 'src/Hypatia/ABI*'; then�[0m
 �[36;1m    echo "::error::Idris2 ABI modules contain prohibited side-effects (IO/unsafe)."�[0m

GitHub Actions: Central Estate CI/CD Audit / estate-audit: ci(secret-scan): canonical estate scanner caller, key scan (D243)

Conclusion: failure

View job details

##[group]Run echo "Validating the Zig unified-api-adapter..."
 �[36;1mecho "Validating the Zig unified-api-adapter..."�[0m
 �[36;1mif find . -name "*.zig" | grep -q .; then�[0m
 �[36;1m  # Ensure it doesn't use standard library io or std.fs directly for FFI�[0m
 �[36;1m  if git grep -E 'std\.fs|std\.io' -- '*.zig'; then�[0m
 �[36;1m    echo "::error::Zig FFI modules contain prohibited side-effects (std.fs/std.io). Must use the unified-api-adapter."�[0m

GitHub Actions: Central Estate CI/CD Audit / estate-audit: ci(secret-scan): canonical estate scanner caller, key scan (D243)

Conclusion: failure

View job details

##[group]Run # This gate used to be a stub: it printed "Checking Justfile syntax..."
 �[36;1m# This gate used to be a stub: it printed "Checking Justfile syntax..."�[0m
 �[36;1m# with the actual command commented out, then delegated "extensiveness"�[0m
 �[36;1m# to a semantic-audit action that is itself unimplemented, then printed�[0m
 �[36;1m# "Recipes Set Validation Passed." It could not fail, and checked nothing.�[0m
 �[36;1m#�[0m
 �[36;1m# It now does the one thing it can do honestly and cheaply: prove the�[0m
 �[36;1m# recipe files parse. `just --summary` parses the whole file and lists�[0m
 �[36;1m# targets WITHOUT executing anything, so it is safe in CI.�[0m
 �[36;1m#�[0m
 �[36;1m# Deliberately NOT checked: whether the recipe set is "extensive" or�[0m
 �[36;1m# "justifiable". Those are judgements, not properties, and a gate that�[0m
 �[36;1m# pretends to measure them is how this action became a stub in the�[0m
 �[36;1m# first place.�[0m
 �[36;1m#�[0m
 �[36;1m# `just --fmt --check` is also deliberately avoided: it enforces�[0m
 �[36;1m# formatting, not validity, and would fail repositories whose Justfiles�[0m
 �[36;1m# are correct but hand-formatted.�[0m
 �[36;1mset -uo pipefail�[0m
 �[36;1mfail=0�[0m
 �[36;1mchecked=0�[0m
 �[36;1m�[0m
 �[36;1m# --- Justfile -----------------------------------------------------�[0m
 �[36;1mjf=""�[0m
 �[36;1mfor c in Justfile justfile .justfile; do [ -f "$c" ] && { jf="$c"; break; }; done�[0m
 �[36;1mif [ -n "$jf" ]; then�[0m
 �[36;1m  if ! command -v just >/dev/null 2>&1; then�[0m
 �[36;1m    echo "Installing just (not on PATH)..."�[0m
 �[36;1m    mkdir -p "$RUNNER_TEMP/just-bin"�[0m
 �[36;1m    if curl --proto '=https' --tlsv1.2 -sSf \�[0m
 �[36;1m         https://just.systems/install.sh \�[0m
 �[36;1m       | bash -s -- --to "$RUNNER_TEMP/just-bin" >/dev/null 2>&1; then�[0m
 �[36;1m      export PATH="$RUNNER_TEMP/just-bin:$PATH"�[0m
 �[36;1m    fi�[0m
 �[36;1m  fi�[0m
 �[36;1m�[0m
 �[36;1m  if command -v just >/dev/null 2...

GitHub Actions: Governance / 4_governance _ Code quality + docs.txt: ci(secret-scan): canonical estate scanner caller, key scan (D243)

Conclusion: failure

View job details

##[group]Run editorconfig-checker/action-editorconfig-checker@840e866d93b8e032123c23bac69dece044d4d84c
 with:
   github-***REDACTED_SECRET_ASSIGNMENT***
   version: latest
 ##[endgroup]
 Find 'latest' release
 ##[error]Error: The binary 'ec-linux-amd64*' not found

GitHub Actions: Governance / governance _ Code quality + docs: ci(secret-scan): canonical estate scanner caller, key scan (D243)

Conclusion: failure

View job details

##[group]Run editorconfig-checker/action-editorconfig-checker@840e866d93b8e032123c23bac69dece044d4d84c
 with:
   github-***REDACTED_SECRET_ASSIGNMENT***
   version: latest
 ##[endgroup]
 Find 'latest' release
 ##[error]Error: The binary 'ec-linux-amd64*' not found

GitHub Actions: Governance / 6_governance _ Security policy checks.txt: ci(secret-scan): canonical estate scanner caller, key scan (D243)

Conclusion: failure

View job details

##[group]Run FAILED=false
 �[36;1mFAILED=false�[0m
 �[36;1mWEAK_CRYPTO=$(grep -rE 'md5\(|sha1\(' --include="*.py" --include="*.rb" --include="*.js" --include="*.ts" --include="*.go" --include="*.rs" . 2>/dev/null | grep -v 'checksum\|cache\|test\|spec' | head -5 || true)�[0m
 �[36;1mif [ -n "$WEAK_CRYPTO" ]; then�[0m
 �[36;1m  echo "::warning::Weak crypto (MD5/SHA1) detected — ADVISORY, does not fail this job. Use SHA256+:"�[0m
 �[36;1m  echo "$WEAK_CRYPTO"�[0m
 �[36;1mfi�[0m
 �[36;1mHTTP_URLS=$(grep -rE 'http://[^l][^o][^c]' --include="*.py" --include="*.js" --include="*.ts" --include="*.go" --include="*.rs" --include="*.yaml" --include="*.yml" . 2>/dev/null | grep -v 'localhost\|127.0.0.1\|example\|test\|spec' | head -5 || true)�[0m
 �[36;1mif [ -n "$HTTP_URLS" ]; then�[0m
 �[36;1m  echo "::warning::HTTP URLs found — ADVISORY, does not fail this job. Use HTTPS:"�[0m
 �[36;1m  echo "$HTTP_URLS"�[0m
 �[36;1mfi�[0m
 �[36;1mSECRETS=$(grep -rEi '(api_key|apikey|secret_key|password)\s*[=:]\s*["\x27][A-Za-z0-9+/=]{20,}' --include="*.py" --include="*.js" --include="*.ts" --include="*.go" --include="*.rs" --include="*.env" . 2>/dev/null | grep -v 'example\|sample\|test\|mock\|placeholder' | head -3 || true)�[0m
 �[36;1mif [ -n "$SECRETS" ]; then�[0m
 �[36;1m  echo "::error::Potential hardcoded secrets detected — this FAILS the job:"�[0m

GitHub Actions: Governance / governance _ Security policy checks: ci(secret-scan): canonical estate scanner caller, key scan (D243)

Conclusion: failure

View job details

##[group]Run FAILED=false
 �[36;1mFAILED=false�[0m
 �[36;1mWEAK_CRYPTO=$(grep -rE 'md5\(|sha1\(' --include="*.py" --include="*.rb" --include="*.js" --include="*.ts" --include="*.go" --include="*.rs" . 2>/dev/null | grep -v 'checksum\|cache\|test\|spec' | head -5 || true)�[0m
 �[36;1mif [ -n "$WEAK_CRYPTO" ]; then�[0m
 �[36;1m  echo "::warning::Weak crypto (MD5/SHA1) detected — ADVISORY, does not fail this job. Use SHA256+:"�[0m
 �[36;1m  echo "$WEAK_CRYPTO"�[0m
 �[36;1mfi�[0m
 �[36;1mHTTP_URLS=$(grep -rE 'http://[^l][^o][^c]' --include="*.py" --include="*.js" --include="*.ts" --include="*.go" --include="*.rs" --include="*.yaml" --include="*.yml" . 2>/dev/null | grep -v 'localhost\|127.0.0.1\|example\|test\|spec' | head -5 || true)�[0m
 �[36;1mif [ -n "$HTTP_URLS" ]; then�[0m
 �[36;1m  echo "::warning::HTTP URLs found — ADVISORY, does not fail this job. Use HTTPS:"�[0m
 �[36;1m  echo "$HTTP_URLS"�[0m
 �[36;1mfi�[0m
 �[36;1mSECRETS=$(grep -rEi '(api_key|apikey|secret_key|password)\s*[=:]\s*["\x27][A-Za-z0-9+/=]{20,}' --include="*.py" --include="*.js" --include="*.ts" --include="*.go" --include="*.rs" --include="*.env" . 2>/dev/null | grep -v 'example\|sample\|test\|mock\|placeholder' | head -3 || true)�[0m
 �[36;1mif [ -n "$SECRETS" ]; then�[0m
 �[36;1m  echo "::error::Potential hardcoded secrets detected — this FAILS the job:"�[0m

GitHub Actions: Governance / governance _ Security policy checks: ci(secret-scan): canonical estate scanner caller, key scan (D243)

Conclusion: failure

View job details

##[group]Run set -uo pipefail
 �[36;1mset -uo pipefail�[0m
 �[36;1mDIR=.github/canonical-references�[0m
 �[36;1mif [ ! -d "$DIR" ]; then�[0m
 �[36;1m  echo "ℹ️  [R5] no $DIR/ — skipped (repo has not opted in)"�[0m
 �[36;1m  exit 0�[0m
 �[36;1mfi�[0m
 �[36;1mif ! command -v python3 >/dev/null 2>&1; then�[0m
 �[36;1m  echo "❌ [R5] python3 missing on runner — required for YAML rule parsing"�[0m
 �[36;1m  exit 2�[0m
 �[36;1mfi�[0m
 �[36;1mpython3 - <<'PY'�[0m
 �[36;1mimport os, sys, glob, subprocess�[0m
 �[36;1mtry:�[0m
 �[36;1m    import yaml�[0m
 �[36;1mexcept ImportError:�[0m
 �[36;1m    sys.exit("❌ [R5] PyYAML not installed on runner; install python3-yaml")�[0m
 �[36;1m�[0m
 �[36;1mdir_ = ".github/canonical-references"�[0m
 �[36;1mfiles = sorted(glob.glob(f"{dir_}/*.yml") + glob.glob(f"{dir_}/*.yaml"))�[0m
 �[36;1mif not files:�[0m
 �[36;1m    print(f"ℹ️  [R5] {dir_}/ has no .yml/.yaml rules — skipped")�[0m
 �[36;1m    sys.exit(0)�[0m
 �[36;1m�[0m
 �[36;1mtotal = 0�[0m
 �[36;1mfor rf in files:�[0m
 �[36;1m    with open(rf, encoding="utf-8") as fh:�[0m
 �[36;1m        cfg = yaml.safe_load(fh)�[0m
 �[36;1m    if not isinstance(cfg, dict):�[0m
 �[36;1m        print(f"❌ [R5] {rf}: top-level must be a mapping"); total += 1; continue�[0m
 �[36;1m    rid  = cfg.get("id", os.path.basename(rf))�[0m
 �[36;1m    desc = cfg.get("description", "")�[0m
 �[36;1m    pats = cfg.get("patterns") or []�[0m
 �[36;1m    canon = cfg.get("canonical_pointer", "")�[0m
 �[36;1m    scope = (cfg.get("scope") or {})�[0m
 �[36;1m    includes = scope.get("include") or []�[0m
 �[36;1m    if not pats or not includes:�[0m
 �[36;1m        print(f"❌ [R5:{rid}] missing patterns or scope.include in {rf}")�[0m
 �[36;1m        total += 1; continue�[0m
 �[36;1m    # exclude self-references�[0m
 �[36;1m    skip = set(["CHANGELOG.md", "CHANGELOG.adoc", rf])�[0m
 �[36;1m    if canon: skip.add(canon)�[0m
 �[36;1m    rule_hits = 0�[0m
 �[36;1m    for f_ in includes:�[0m
 �[36;1m        if f_ in skip or not os...

GitHub Actions: Governance / 7_governance _ Workflow security linter.txt: ci(secret-scan): canonical estate scanner caller, key scan (D243)

Conclusion: failure

View job details

##[group]Run if [ "$GITHUB_REPOSITORY" = hyperpolymath/standards ]; then
 �[36;1mif [ "$GITHUB_REPOSITORY" = hyperpolymath/standards ]; then�[0m
 �[36;1m  SCRIPT="tools/policy/check-workflows-parse.sh"�[0m
 �[36;1m  echo "Using this repository's own copy (standards self-lint)."�[0m
 �[36;1melse�[0m
 �[36;1m  SCRIPT=".standards-dupkey/tools/policy/check-workflows-parse.sh"�[0m
 �[36;1mfi�[0m
 �[36;1mif [ ! -f "$SCRIPT" ]; then�[0m
 �[36;1m  echo "::error::workflow parser gate not found in the pinned Standards revision or locally"�[0m

GitHub Actions: Governance / governance _ Workflow security linter: ci(secret-scan): canonical estate scanner caller, key scan (D243)

Conclusion: failure

View job details

##[group]Run if [ "$GITHUB_REPOSITORY" = hyperpolymath/standards ]; then
 �[36;1mif [ "$GITHUB_REPOSITORY" = hyperpolymath/standards ]; then�[0m
 �[36;1m  SCRIPT="tools/policy/check-workflows-parse.sh"�[0m
 �[36;1m  echo "Using this repository's own copy (standards self-lint)."�[0m
 �[36;1melse�[0m
 �[36;1m  SCRIPT=".standards-dupkey/tools/policy/check-workflows-parse.sh"�[0m
 �[36;1mfi�[0m
 �[36;1mif [ ! -f "$SCRIPT" ]; then�[0m
 �[36;1m  echo "::error::workflow parser gate not found in the pinned Standards revision or locally"�[0m

GitHub Actions: Governance / governance _ Workflow security linter: ci(secret-scan): canonical estate scanner caller, key scan (D243)

Conclusion: failure

View job details

##[group]Run # GitHub Actions REJECTS a workflow with duplicate keys: the run is
 �[36;1m# GitHub Actions REJECTS a workflow with duplicate keys: the run is�[0m
 �[36;1m# `failure` with no jobs, no log and no check run. Nothing else here�[0m
 �[36;1m# can see it, because yaml.safe_load silently keeps the LAST�[0m
 �[36;1m# duplicate and reports success — so the file "parses" and every�[0m
 �[36;1m# other lint passes. Measured 2026-08-05: nine workflows in hypatia�[0m
 �[36;1m# were dead this way, including a CodeQL workflow with zero�[0m
 �[36;1m# successful runs in its entire lifetime.�[0m
 �[36;1mset -euo pipefail�[0m
 �[36;1m# Standards exercises its pull-request scripts; every consumer uses�[0m
 �[36;1m# the canonical scripts fetched from this workflow's immutable�[0m
 �[36;1m# Standards revision.�[0m
 �[36;1mif [ "$GITHUB_REPOSITORY" = hyperpolymath/standards ]; then�[0m
 �[36;1m  SCRIPT="scripts/check-workflow-duplicate-keys.sh"�[0m
 �[36;1m  echo "Using this repository's own copy (standards self-lint)."�[0m
 �[36;1melse�[0m
 �[36;1m  SCRIPT=".standards-dupkey/scripts/check-workflow-duplicate-keys.sh"�[0m
 �[36;1mfi�[0m
 �[36;1mif [ ! -f "$SCRIPT" ]; then�[0m
 �[36;1m  echo "::error::duplicate-key checker not found — neither fetched from" \�[0m

GitHub Actions: Governance / governance _ Workflow security linter: ci(secret-scan): canonical estate scanner caller, key scan (D243)

Conclusion: failure

View job details

##[group]Run failed=0
 �[36;1mfailed=0�[0m
 �[36;1mfor file in .github/workflows/*.yml .github/workflows/*.yaml; do�[0m
 �[36;1m  [ -f "$file" ] || continue�[0m
 �[36;1m  # ⚠ SCAN THE HEADER BLOCK, NOT LINE 1. REUSE places the identifier�[0m
 �[36;1m  # anywhere in a file's leading comment block, and `gh actions-lock`�[0m
 �[36;1m  # INSERTS `# This workflow is managed by gh actions-lock.` at line 1�[0m
 �[36;1m  # whenever it mints a lockfile — so a line-1 test fights the estate's�[0m
 �[36;1m  # own tool and re-fails every time a lockfile is refreshed.�[0m
 �[36;1m  #�[0m
 �[36;1m  # Measured 2026-08-07: it reported 27 hypatia workflows and 13 more�[0m
 �[36;1m  # elsewhere as missing a header they all had, and "fixing" that by�[0m
 �[36;1m  # prepending a default MIS-LICENSED three files (PMPL-1.0-or-later�[0m
 �[36;1m  # shadowed by MPL-2.0) before it was caught.�[0m
 �[36;1m  #�[0m
 �[36;1m  # The leading run of comment lines is read, tolerating a YAML�[0m
 �[36;1m  # document marker. A licence declared there is declared.�[0m
 �[36;1m  if ! awk '/^---[[:space:]]*$/ { next } /^#/ { print; next } { exit }' "$file" \�[0m
 �[36;1m       | grep -q "^# SPDX-License-Identifier:"; then�[0m
 �[36;1m    echo "ERROR: $file has no SPDX-License-Identifier in its header comment block"; failed=1�[0m
 �[36;1m  fi�[0m
 �[36;1m  if ! grep -q "^permissions:" "$file"; then�[0m
 �[36;1m    echo "ERROR: $file missing top-level 'permissions:' declaration"; failed=1�[0m
 �[36;1m  fi�[0m
 �[36;1mdone�[0m
 �[36;1m[ $failed -eq 1 ] && { echo "Add SPDX header + permissions:"; exit 1; }�[0m
 �[36;1mecho "All workflows have SPDX headers + permissions"�[0m
 shell: /usr/bin/bash -e {0}
 ##[endgroup]
 ERROR: .github/workflows/main-estate-audit.yml missing top-level 'permissions:' declaration
 Add SPDX header + permissions:
 ##[error]Process completed with exit code 1.

GitHub Actions: Governance / 10_governance _ Actions lockfile verify.txt: ci(secret-scan): canonical estate scanner caller, key scan (D243)

Conclusion: failure

View job details

##[group]Run set -uo pipefail
 �[36;1mset -uo pipefail�[0m
 �[36;1mif [ "$GITHUB_REPOSITORY" = hyperpolymath/standards ]; then�[0m
 �[36;1m  SRC=scripts�[0m
 �[36;1m  echo "Using this repository's own gate + verifier (standards self-lint)."�[0m
 �[36;1melse�[0m
 �[36;1m  SRC=.standards-lock/scripts�[0m
 �[36;1mfi�[0m
 �[36;1mfor f in check-actions-lock-gate.sh update-actions-lock.sh; do�[0m
 �[36;1m  if [ ! -f "$SRC/$f" ]; then�[0m
 �[36;1m    echo "::error::actions-lock gate: $f not found in $SRC (standards checkout at job.workflow_sha failed?)"�[0m

GitHub Actions: Governance / governance _ Actions lockfile verify: ci(secret-scan): canonical estate scanner caller, key scan (D243)

Conclusion: failure

View job details

##[group]Run set -uo pipefail
 �[36;1mset -uo pipefail�[0m
 �[36;1mif [ "$GITHUB_REPOSITORY" = hyperpolymath/standards ]; then�[0m
 �[36;1m  SRC=scripts�[0m
 �[36;1m  echo "Using this repository's own gate + verifier (standards self-lint)."�[0m
 �[36;1melse�[0m
 �[36;1m  SRC=.standards-lock/scripts�[0m
 �[36;1mfi�[0m
 �[36;1mfor f in check-actions-lock-gate.sh update-actions-lock.sh; do�[0m
 �[36;1m  if [ ! -f "$SRC/$f" ]; then�[0m
 �[36;1m    echo "::error::actions-lock gate: $f not found in $SRC (standards checkout at job.workflow_sha failed?)"�[0m

GitHub Actions: Governance / 11_governance _ Well-Known (RFC 9116 + RSR).txt: ci(secret-scan): canonical estate scanner caller, key scan (D243)

Conclusion: failure

View job details

##[group]Run SECTXT=""
 �[36;1mSECTXT=""�[0m
 �[36;1m[ -f ".well-known/security.txt" ] && SECTXT=".well-known/security.txt"�[0m
 �[36;1m[ -f "security.txt" ] && SECTXT="security.txt"�[0m
 �[36;1mif [ -z "$SECTXT" ]; then�[0m
 �[36;1m  echo "::warning::No security.txt found."�[0m
 �[36;1m  exit 0�[0m
 �[36;1mfi�[0m
 �[36;1mgrep -q "^Contact:" "$SECTXT" || { echo "::error::Missing Contact field"; exit 1; }�[0m

GitHub Actions: Governance / governance _ Well-Known (RFC 9116 + RSR): ci(secret-scan): canonical estate scanner caller, key scan (D243)

Conclusion: failure

View job details

##[group]Run SECTXT=""
 �[36;1mSECTXT=""�[0m
 �[36;1m[ -f ".well-known/security.txt" ] && SECTXT=".well-known/security.txt"�[0m
 �[36;1m[ -f "security.txt" ] && SECTXT="security.txt"�[0m
 �[36;1mif [ -z "$SECTXT" ]; then�[0m
 �[36;1m  echo "::warning::No security.txt found."�[0m
 �[36;1m  exit 0�[0m
 �[36;1mfi�[0m
 �[36;1mgrep -q "^Contact:" "$SECTXT" || { echo "::error::Missing Contact field"; exit 1; }�[0m

GitHub Actions: Governance / governance _ Well-Known (RFC 9116 + RSR): ci(secret-scan): canonical estate scanner caller, key scan (D243)

Conclusion: failure

View job details

##[group]Run MIXED=$(grep -rE 'src="http://|href="http://' --include="*.html" --include="*.htm" . 2>/dev/null | grep -vE 'localhost|127\.0\.0\.1|example\.com|lol/|node_modules/|third-party/|vendor/' | head -5 || true)
 �[36;1mMIXED=$(grep -rE 'src="http://|href="http://' --include="*.html" --include="*.htm" . 2>/dev/null | grep -vE 'localhost|127\.0\.0\.1|example\.com|lol/|node_modules/|third-party/|vendor/' | head -5 || true)�[0m
 �[36;1mif [ -n "$MIXED" ]; then�[0m
 �[36;1m  echo "::error::Mixed content (HTTP in HTML)"�[0m

GitHub Actions: Governance / 12_governance _ Language _ package anti-pattern policy.txt: ci(secret-scan): canonical estate scanner caller, key scan (D243)

Conclusion: failure

View job details

##[group]Run SCRIPT=".standards-checkout/scripts/check-ts-allowlist.sh"
 �[36;1mSCRIPT=".standards-checkout/scripts/check-ts-allowlist.sh"�[0m
 �[36;1mif [ ! -f "$SCRIPT" ] && [ "$GITHUB_REPOSITORY" = "hyperpolymath/standards" ] \�[0m
 �[36;1m   && [ -f scripts/check-ts-allowlist.sh ]; then�[0m
 �[36;1m  SCRIPT="scripts/check-ts-allowlist.sh"�[0m
 �[36;1m  echo "Using this repository's own copy (standards self-check)."�[0m
 �[36;1mfi�[0m
 �[36;1mif [ ! -f "$SCRIPT" ]; then�[0m
 �[36;1m  echo "::error::check-ts-allowlist gate not found in standards@main or locally"�[0m

GitHub Actions: Governance / governance _ Language _ package anti-pattern policy: ci(secret-scan): canonical estate scanner caller, key scan (D243)

Conclusion: failure

View job details

##[group]Run SCRIPT=".standards-checkout/scripts/check-ts-allowlist.sh"
 �[36;1mSCRIPT=".standards-checkout/scripts/check-ts-allowlist.sh"�[0m
 �[36;1mif [ ! -f "$SCRIPT" ] && [ "$GITHUB_REPOSITORY" = "hyperpolymath/standards" ] \�[0m
 �[36;1m   && [ -f scripts/check-ts-allowlist.sh ]; then�[0m
 �[36;1m  SCRIPT="scripts/check-ts-allowlist.sh"�[0m
 �[36;1m  echo "Using this repository's own copy (standards self-check)."�[0m
 �[36;1mfi�[0m
 �[36;1mif [ ! -f "$SCRIPT" ]; then�[0m
 �[36;1m  echo "::error::check-ts-allowlist gate not found in standards@main or locally"�[0m

GitHub Actions: Governance / governance _ Language _ package anti-pattern policy: ci(secret-scan): canonical estate scanner caller, key scan (D243)

Conclusion: failure

View job details

##[group]Run SCRIPT=".standards-checkout/tools/policy/check-language-policy.sh"
 �[36;1mSCRIPT=".standards-checkout/tools/policy/check-language-policy.sh"�[0m
 �[36;1mif [ ! -f "$SCRIPT" ] && [ -f tools/policy/check-language-policy.sh ]; then�[0m
 �[36;1m  SCRIPT="tools/policy/check-language-policy.sh"�[0m
 �[36;1m  echo "Using this repository's own copy (standards self-check)."�[0m
 �[36;1mfi�[0m
 �[36;1mif [ ! -f "$SCRIPT" ]; then�[0m
 �[36;1m  echo "::error::language-policy gate not found in standards@main or locally"�[0m
📝 Summary

Summary by CodeRabbit

  • Chores
    • Automated secret scanning continues for pull requests and pushes to the main branch, now through a shared scanning workflow.
    • The previous individual scanner steps, including the Rust-specific scan, have been removed. The workflow no longer requests read access to action metadata.

Walkthrough

The secret-scanner workflow replaces its inline TruffleHog, Gitleaks, and Rust scanning jobs with a call to a pinned reusable workflow. It retains its triggers, concurrency settings, and contents: read permission.

Changes

Secret scanner workflow

Layer / File(s) Summary
Reusable scanner invocation
.github/workflows/secret-scanner.yml		 The workflow comments describe the shared scanner setup. The scan job calls the pinned reusable workflow. The workflow removes the inline scanner jobs and no longer grants actions: read.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~8 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to 5caff

The reusable scanner preserves the intended required check without requiring repository secrets. No concrete merge-blocking issue remains; merge after normal checks pass.

Architecture Summary

Architecture risk: 🔵 Low · up to 5caff

The changed surface does not map to a changed system, dependency edge, entrypoint, or external dependency.

Changed systems: None identified.

Architecture concerns
No architecture-level concerns identified.

Review details

Before / after behavior

  • observed — Modified behavior in .github/workflows/secret-scanner.yml: The comments now describe the shared secret scanner, its required scan job key, and the absence of a secrets: declaration; the prior workflow-management and concurrency commentary is removed.
  • observed — Modified behavior in .github/workflows/secret-scanner.yml: The inline trufflehog, gitleaks, and rust-secrets jobs and their scanning steps are replaced by a scan job calling the pinned reusable workflow. The workflow no longer grants actions: read; contents: read remains.
🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Description check ⚠️ Warning The description explains the purpose, implementation, scanner context, reusable workflow, and actionlint result. It does not use the required Summary, Changes, RSR Quality Checklist, Testing, or Scree… Rewrite the description using the repository template. Add the Summary, Changes, RSR Quality Checklist, Testing, and Screenshots sections. Mark each applicable checklist item and state the exact validation command and result, including any …
✅ Passed checks (4 passed)
Check name Status Explanation
Title check ✅ Passed The title clearly identifies the main change: replacing the inline secret scan with the canonical estate scanner caller.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Full details: Description check

Explanation

The description explains the purpose, implementation, scanner context, reusable workflow, and actionlint result. It does not use the required Summary, Changes, RSR Quality Checklist, Testing, or Screenshots sections, and it does not record the required checklist results or a complete test command.

Resolution

Rewrite the description using the repository template. Add the Summary, Changes, RSR Quality Checklist, Testing, and Screenshots sections. Mark each applicable checklist item and state the exact validation command and result, including any reason an item is not applicable.

✨ Finishing Touches 💡 1
🛠️ Fix failing CI checks 💡
  • Commit to this branch
  • Create a new PR
  • Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

A rabbit checks the scanner’s trail,
Then calls a shared workflow without fail.
No inline scans remain in view,
A pinned call runs the work anew.
The rabbit hops with secrets in check.

Comment @coderabbitai help to get the list of available commands.

@github-actions

github-actions Bot commented Oct 1, 2026

Copy link
Copy Markdown

🔍 Hypatia Security Scan

Findings: 82 issues detected

Severity Count
🔴 Critical 6
🟠 High 18
🟡 Medium 58

⚠️ Action Required: Critical security issues found!

View findings 
[
  {
    "reason": "No permissions declaration -- add permissions: read-all",
    "type": "missing_permissions",
    "file": ".github/workflows/main-estate-audit.yml",
    "action": "add_permissions",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Job `trigger-boj` in boj-build.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).",
    "type": "missing_timeout_minutes",
    "file": ".github/workflows/boj-build.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium",
    "recipe_id": "recipe-add-workflow-timeout-minutes",
    "job": "trigger-boj"
  },
  {
    "reason": "Job `build` in casket-pages.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).",
    "type": "missing_timeout_minutes",
    "file": ".github/workflows/casket-pages.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium",
    "recipe_id": "recipe-add-workflow-timeout-minutes",
    "job": "build"
  },
  {
    "reason": "Job `deploy` in casket-pages.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).",
    "type": "missing_timeout_minutes",
    "file": ".github/workflows/casket-pages.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium",
    "recipe_id": "recipe-add-workflow-timeout-minutes",
    "job": "deploy"
  },
  {
    "reason": "Job `analyze` in codeql.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).",
    "type": "missing_timeout_minutes",
    "file": ".github/workflows/codeql.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium",
    "recipe_id": "recipe-add-workflow-timeout-minutes",
    "job": "analyze"
  },
  {
    "reason": "Job `automerge` in dependabot-automerge.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).",
    "type": "missing_timeout_minutes",
    "file": ".github/workflows/dependabot-automerge.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium",
    "recipe_id": "recipe-add-workflow-timeout-minutes",
    "job": "automerge"
  },
  {
    "reason": "Job `deed-validate` in dogfood-gate.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).",
    "type": "missing_timeout_minutes",
    "file": ".github/workflows/dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium",
    "recipe_id": "recipe-add-workflow-timeout-minutes",
    "job": "deed-validate"
  },
  {
    "reason": "Job `dogfood-summary` in dogfood-gate.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).",
    "type": "missing_timeout_minutes",
    "file": ".github/workflows/dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium",
    "recipe_id": "recipe-add-workflow-timeout-minutes",
    "job": "dogfood-summary"
  },
  {
    "reason": "Job `eclexiaiser-validate` in dogfood-gate.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).",
    "type": "missing_timeout_minutes",
    "file": ".github/workflows/dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium",
    "recipe_id": "recipe-add-workflow-timeout-minutes",
    "job": "eclexiaiser-validate"
  },
  {
    "reason": "Job `empty-lint` in dogfood-gate.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).",
    "type": "missing_timeout_minutes",
    "file": ".github/workflows/dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium",
    "recipe_id": "recipe-add-workflow-timeout-minutes",
    "job": "empty-lint"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence

@hyperpolymath @claude
ci(actions-lock): empty the secret-scanner.yml key for the reusable c…
48e080f 
…aller

The caller's only uses: is a job-level reusable workflow, which actions.lock does
not track; the stale step entries left from the inline scanner made GitHub refuse
to start the workflow (startup_failure, jobs=0). Verified: standards
check-actions-lock-gate.sh rc=0 and gh actions-lock --no-fix valid=true.
gh actions-lock does not rewrite this key itself (D283).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0136eszqrQ53Kj7aBH1D4rXK
@github-actions

github-actions Bot commented Oct 1, 2026

Copy link
Copy Markdown

🔍 Hypatia Security Scan

Findings: 96 issues detected

Severity Count
🔴 Critical 6
🟠 High 18
🟡 Medium 72

⚠️ Action Required: Critical security issues found!

View findings 
[
  {
    "reason": "No permissions declaration -- add permissions: read-all",
    "type": "missing_permissions",
    "file": ".github/workflows/main-estate-audit.yml",
    "action": "add_permissions",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Job `trigger-boj` in boj-build.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).",
    "type": "missing_timeout_minutes",
    "file": ".github/workflows/boj-build.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium",
    "recipe_id": "recipe-add-workflow-timeout-minutes",
    "job": "trigger-boj"
  },
  {
    "reason": "Job `build` in casket-pages.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).",
    "type": "missing_timeout_minutes",
    "file": ".github/workflows/casket-pages.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium",
    "recipe_id": "recipe-add-workflow-timeout-minutes",
    "job": "build"
  },
  {
    "reason": "Job `deploy` in casket-pages.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).",
    "type": "missing_timeout_minutes",
    "file": ".github/workflows/casket-pages.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium",
    "recipe_id": "recipe-add-workflow-timeout-minutes",
    "job": "deploy"
  },
  {
    "reason": "Job `analyze` in codeql.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).",
    "type": "missing_timeout_minutes",
    "file": ".github/workflows/codeql.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium",
    "recipe_id": "recipe-add-workflow-timeout-minutes",
    "job": "analyze"
  },
  {
    "reason": "Job `automerge` in dependabot-automerge.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).",
    "type": "missing_timeout_minutes",
    "file": ".github/workflows/dependabot-automerge.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium",
    "recipe_id": "recipe-add-workflow-timeout-minutes",
    "job": "automerge"
  },
  {
    "reason": "Job `deed-validate` in dogfood-gate.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).",
    "type": "missing_timeout_minutes",
    "file": ".github/workflows/dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium",
    "recipe_id": "recipe-add-workflow-timeout-minutes",
    "job": "deed-validate"
  },
  {
    "reason": "Job `dogfood-summary` in dogfood-gate.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).",
    "type": "missing_timeout_minutes",
    "file": ".github/workflows/dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium",
    "recipe_id": "recipe-add-workflow-timeout-minutes",
    "job": "dogfood-summary"
  },
  {
    "reason": "Job `eclexiaiser-validate` in dogfood-gate.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).",
    "type": "missing_timeout_minutes",
    "file": ".github/workflows/dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium",
    "recipe_id": "recipe-add-workflow-timeout-minutes",
    "job": "eclexiaiser-validate"
  },
  {
    "reason": "Job `empty-lint` in dogfood-gate.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).",
    "type": "missing_timeout_minutes",
    "file": ".github/workflows/dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium",
    "recipe_id": "recipe-add-workflow-timeout-minutes",
    "job": "empty-lint"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence

@hyperpolymath
hyperpolymath merged commit 70b0bbc into main Oct 1, 2026
32 of 34 checks passed
@hyperpolymath
hyperpolymath deleted the ci/secret-scan-floor-caller branch October 1, 2026 23:42
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@coderabbitai coderabbitai[bot] coderabbitai[bot] approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@hyperpolymath