From fc41926c8bae37cbe346ec9e32d9d1c258183c0b Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Fri, 2 Oct 2026 00:38:49 +0100 Subject: [PATCH 1/3] ci(secret-scan): canonical estate scanner caller, key scan (D243) Secret-Scan-Floor (D243/D244) requires the context `scan / gitleaks` estate-wide. The previous inline scanner jobs emitted bare contexts (e.g. `gitleaks`) that cannot satisfy the floor; the reusable deliberately drops TruffleHog as redundant with gitleaks. Write the canonical caller: job key `scan`, reusable pinned to standards@74d2f66, push trigger on the default branch `main`. actionlint: new file clean (findings in previous file: 1). Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_0136eszqrQ53Kj7aBH1D4rXK --- .github/workflows/secret-scanner.yml | 78 +++++++--------------------- 1 file changed, 18 insertions(+), 60 deletions(-) diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index a5c8b31..fa6eb1f 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -1,7 +1,13 @@ -# This workflow is managed by gh actions-lock. -# SPDX-License-Identifier: MPL-2.0-or-later -# This workflow is managed by gh actions-lock. -# Prevention workflow - scans for hardcoded secrets before they reach main +# SPDX-License-Identifier: MPL-2.0 +# Prevention workflow - scans for hardcoded secrets before they reach main. +# +# Calls the estate's shared secret scanner (gitleaks + rust-secrets + +# shell-secrets). The job key MUST stay `scan`: the estate-wide +# Secret-Scan-Floor ruleset requires the check context `scan / gitleaks`. +# +# No `secrets:` line, deliberately: the reusable references no secrets +# (gitleaks runs as a checksum-verified binary, not gitleaks-action), so +# `secrets: inherit` would only hand it every repo and org secret (CWE-250). name: Secret Scanner on: @@ -9,61 +15,13 @@ on: push: branches: [main] -permissions: read-all +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true -jobs: - trufflehog: - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v7.0.1 - with: - fetch-depth: 0 # Full history for scanning - - - name: TruffleHog Secret Scan - uses: trufflesecurity/trufflehog@v3.97.6 - with: - extra_args: --only-verified --fail - - gitleaks: - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v7.0.1 - with: - fetch-depth: 0 - - - name: Gitleaks Secret Scan - uses: gitleaks/gitleaks-action@v3.0.0 - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} +permissions: + contents: read - # Rust-specific: Check for hardcoded crypto values - rust-secrets: - runs-on: ubuntu-latest - if: hashFiles('**/Cargo.toml') != '' - steps: - - uses: actions/checkout@v7.0.1 - - - name: Check for hardcoded secrets in Rust - run: | - # Patterns that suggest hardcoded secrets - PATTERNS=( - 'const.*SECRET.*=.*"' - 'const.*KEY.*=.*"[a-zA-Z0-9]{16,}"' - 'const.*TOKEN.*=.*"' - 'let.*api_key.*=.*"' - 'HMAC.*"[a-fA-F0-9]{32,}"' - 'password.*=.*"[^"]+"' - ) - - found=0 - for pattern in "${PATTERNS[@]}"; do - if grep -rn --include="*.rs" -E "$pattern" src/; then - echo "WARNING: Potential hardcoded secret found matching: $pattern" - found=1 - fi - done - - if [ $found -eq 1 ]; then - echo "::error::Potential hardcoded secrets detected. Use environment variables instead." - exit 1 - fi +jobs: + scan: + uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@74d2f66f575246cf6e313ae7775f44df6e097ff2 From f8ec0d2fc82d5972b60e45863d7afff70e00b02f Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Fri, 2 Oct 2026 00:43:45 +0100 Subject: [PATCH 2/3] ci(actions-lock): empty the secret-scanner.yml key for the reusable caller The caller's only uses: is a job-level reusable workflow, which actions.lock does not track; the stale step entries left from the inline scanner made GitHub refuse to start the workflow (startup_failure, jobs=0). Verified: standards check-actions-lock-gate.sh finding set unchanged by this edit (6 pre-existing findings on other workflows, none on secret-scanner.yml). gh actions-lock does not rewrite this key itself (D283). Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_0136eszqrQ53Kj7aBH1D4rXK --- .github/workflows/actions.lock | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock index d5f0b0f..b910b72 100644 --- a/.github/workflows/actions.lock +++ b/.github/workflows/actions.lock @@ -35,10 +35,7 @@ workflows: - 'actions/checkout@v7.0.1' - 'github/codeql-action@v4.38.0' - 'ossf/scorecard-action@v2.4.4' - '.github/workflows/secret-scanner.yml': - - 'actions/checkout@v7.0.1' - - 'gitleaks/gitleaks-action@v3.0.0' - - 'trufflesecurity/trufflehog@v3.97.4' + '.github/workflows/secret-scanner.yml': [] dependencies: 'actions/checkout@v7.0.1': ref: 'v7.0.1' From b3fc0e118de54f68845bd5f459a1caf1e042d3c4 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Fri, 2 Oct 2026 00:46:48 +0100 Subject: [PATCH 3/3] Update .github/workflows/secret-scanner.yml Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com> --- .github/workflows/secret-scanner.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index fa6eb1f..e376e62 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -17,7 +17,7 @@ on: concurrency: group: ${{ github.workflow }}-${{ github.ref }} - cancel-in-progress: true + cancel-in-progress: ${{ github.event_name == 'pull_request' }} permissions: contents: read