ci(secret-scan): canonical estate scanner caller, key scan (D243)

.github/workflows/actions.lock

@@ -35,10 +35,7 @@ workflows:
         - 'actions/checkout@v7.0.1'
         - 'github/codeql-action@v4.38.0'
         - 'ossf/scorecard-action@v2.4.4'
-    '.github/workflows/secret-scanner.yml':
-        - 'actions/checkout@v7.0.1'
-        - 'gitleaks/gitleaks-action@v3.0.0'
-        - 'trufflesecurity/trufflehog@v3.97.4'
+    '.github/workflows/secret-scanner.yml': []
 dependencies:
     'actions/checkout@v7.0.1':
         ref: 'v7.0.1'

.github/workflows/secret-scanner.yml

@@ -1,69 +1,27 @@
-# This workflow is managed by gh actions-lock.
-# SPDX-License-Identifier: MPL-2.0-or-later
-# This workflow is managed by gh actions-lock.
-# Prevention workflow - scans for hardcoded secrets before they reach main
+# SPDX-License-Identifier: MPL-2.0
+# Prevention workflow - scans for hardcoded secrets before they reach main.
+#
+# Calls the estate's shared secret scanner (gitleaks + rust-secrets +
+# shell-secrets). The job key MUST stay `scan`: the estate-wide
+# Secret-Scan-Floor ruleset requires the check context `scan / gitleaks`.
+#
+# No `secrets:` line, deliberately: the reusable references no secrets
+# (gitleaks runs as a checksum-verified binary, not gitleaks-action), so
+# `secrets: inherit` would only hand it every repo and org secret (CWE-250).
 name: Secret Scanner
 
 on:
   pull_request:
   push:
     branches: [main]
 
-permissions: read-all
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
-jobs:
-  trufflehog:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v7.0.1
-        with:
-          fetch-depth: 0  # Full history for scanning
-
-      - name: TruffleHog Secret Scan
-        uses: trufflesecurity/trufflehog@v3.97.6
-        with:
-          extra_args: --only-verified --fail
-
-  gitleaks:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v7.0.1
-        with:
-          fetch-depth: 0
-
-      - name: Gitleaks Secret Scan
-        uses: gitleaks/gitleaks-action@v3.0.0
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+permissions:
+  contents: read
 
-  # Rust-specific: Check for hardcoded crypto values
-  rust-secrets:
-    runs-on: ubuntu-latest
-    if: hashFiles('**/Cargo.toml') != ''
-    steps:
-      - uses: actions/checkout@v7.0.1
-
-      - name: Check for hardcoded secrets in Rust
-        run: |
-          # Patterns that suggest hardcoded secrets
-          PATTERNS=(
-            'const.*SECRET.*=.*"'
-            'const.*KEY.*=.*"[a-zA-Z0-9]{16,}"'
-            'const.*TOKEN.*=.*"'
-            'let.*api_key.*=.*"'
-            'HMAC.*"[a-fA-F0-9]{32,}"'
-            'password.*=.*"[^"]+"'
-          )
-
-          found=0
-          for pattern in "${PATTERNS[@]}"; do
-            if grep -rn --include="*.rs" -E "$pattern" src/; then
-              echo "WARNING: Potential hardcoded secret found matching: $pattern"
-              found=1
-            fi
-          done
-
-          if [ $found -eq 1 ]; then
-            echo "::error::Potential hardcoded secrets detected. Use environment variables instead."
-            exit 1
-          fi
+jobs:
+  scan:
+    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@74d2f66f575246cf6e313ae7775f44df6e097ff2