From cfbb7b60f5206c4e5be1d46332f1f82966f9a8c6 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Thu, 1 Oct 2026 13:56:01 +0100 Subject: [PATCH 1/2] ci(secret-scan): canonical estate scanner caller, key scan (D243) Secret-Scan-Floor (D243/D244) requires the context `scan / gitleaks` estate-wide. The previous caller pinned a reusable that no longer resolves (or the file was invalid), so the scanner never ran. Write the canonical caller: job key `scan`, reusable pinned to standards@74d2f66, push trigger on the default branch `main`. actionlint: new file clean (findings in previous file: 6). Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_0136eszqrQ53Kj7aBH1D4rXK --- .github/workflows/secret-scanner.yml | 21 +++++++++------------ 1 file changed, 9 insertions(+), 12 deletions(-) diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index 5e5be7f..f04a556 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -1,4 +1,12 @@ # SPDX-License-Identifier: MPL-2.0 +# Prevention workflow - scans for hardcoded secrets before they reach main. +# +# Calls the estate's shared secret scanner (gitleaks + rust-secrets + +# shell-secrets). The job key MUST stay `scan`: the estate-wide +# Secret-Scan-Floor ruleset requires the check context `scan / gitleaks`. +# +# `secrets: inherit` is REQUIRED - without it the gitleaks action's inner +# secrets.GITHUB_TOKEN is empty and the scan silently degrades. name: Secret Scanner on: @@ -15,16 +23,5 @@ permissions: jobs: scan: - permissions: - actions: read - contents: read - security-events: write -# The reusable's gitleaks job requests pull-requests: write (PR summary - # comment) and actions: read (workflow-run metadata) at job level; the - # caller must grant at least that or the run startup-fails. - permissions: - contents: read - pull-requests: write - actions: read - uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@c65436ee3351cd6b0fa14b142938b195efc77586 + uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@74d2f66f575246cf6e313ae7775f44df6e097ff2 secrets: inherit From 9cdf796d276254ad592a7bfdebbc7c28e2687b65 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Thu, 1 Oct 2026 14:04:31 +0100 Subject: [PATCH 2/2] ci(secret-scan): drop secrets: inherit from the scanner caller (least privilege) The reusable at standards@74d2f66 references no secrets: gitleaks runs as a checksum-verified binary, not gitleaks-action, so `secrets: inherit` only forwarded every repository and organisation secret to it (CWE-250, flagged by CodeRabbit and Hypatia WH008). The earlier comment calling it REQUIRED was copied from the reusable's own stale header note and is corrected here. actionlint clean. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_0136eszqrQ53Kj7aBH1D4rXK --- .github/workflows/secret-scanner.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index f04a556..fa6eb1f 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -5,8 +5,9 @@ # shell-secrets). The job key MUST stay `scan`: the estate-wide # Secret-Scan-Floor ruleset requires the check context `scan / gitleaks`. # -# `secrets: inherit` is REQUIRED - without it the gitleaks action's inner -# secrets.GITHUB_TOKEN is empty and the scan silently degrades. +# No `secrets:` line, deliberately: the reusable references no secrets +# (gitleaks runs as a checksum-verified binary, not gitleaks-action), so +# `secrets: inherit` would only hand it every repo and org secret (CWE-250). name: Secret Scanner on: @@ -24,4 +25,3 @@ permissions: jobs: scan: uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@74d2f66f575246cf6e313ae7775f44df6e097ff2 - secrets: inherit