ci(secret-scan): rename caller job key secret-scan -> scan (D243)

[hyperpolymath]

What

Rename the secret-scanner caller job key secret-scan → scan in .github/workflows/secret-scanner.yml, so the check context becomes scan / gitleaks — the context the estate Secret-Scan-Floor ruleset (D243/D244) requires. One-line change; reusable pin, triggers and permissions unchanged. actionlint output is identical before and after.

Commit created via GraphQL createCommitOnBranch (GitHub-signed, signature valid: true).

🤖 Generated with Claude Code

https://claude.ai/code/session_0136eszqrQ53Kj7aBH1D4rXK

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 271566c0-de08-4d0f-88f3-9dab71734dcf

📥 Commits

Reviewing files that changed from the base of the PR and between 48f768f and eae3457.

📒 Files selected for processing (1)

• .github/workflows/secret-scanner.yml

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

⏰ Context from checks skipped due to timeout. (6)

• GitHub Check: scan / rust-secrets
• GitHub Check: hypatia / Hypatia Neurosymbolic Analysis
• GitHub Check: scan / gitleaks
• GitHub Check: estate-audit
• GitHub Check: CodeQL Analysis (actions, none)
• GitHub Check: semgrep-cloud-platform/scan

⚠️ CI failures not shown inline (4)

GitHub Actions: Central Estate CI/CD Audit / 0_estate-audit.txt: ci(secret-scan): rename caller job key secret-scan -> scan (D243)

Conclusion: failure

View job details

##[group]Run # Accepted placements widened per owner ruling 2026-09-19: estate
 �[36;1m# Accepted placements widened per owner ruling 2026-09-19: estate�[0m
 �[36;1m# repos legitimately keep governance docs under docs/ (and GitHub�[0m
 �[36;1m# renders under .github/) — rsr-template-repo itself was failing on�[0m
 �[36;1m# layout, not on substance. Root forms still win (first hit).�[0m
 �[36;1m# Template-repo mode: see below.�[0m
 �[36;1m#�[0m
 �[36;1m# Presence-only checking rewards filler. This gate previously demanded�[0m
 �[36;1m# ARCHITECTURE.md / MAINTAINERS.adoc / GOVERNANCE.md and checked only�[0m
 �[36;1m# that the paths existed — so the cheapest way to pass was to commit�[0m
 �[36;1m# template boilerplate. That happened: an estate repo acquired an�[0m
 �[36;1m# ARCHITECTURE.md describing a directory layout it does not have, a�[0m
 �[36;1m# MAINTAINERS naming a different account as owner, and a mise.toml�[0m
 �[36;1m# pinning `zig = "latest"` against that repo's own .tool-versions.�[0m
 �[36;1m# All three would have passed. So: presence, THEN format, THEN substance.�[0m
 �[36;1m#�[0m
 �[36;1m# Format policy (estate):�[0m
 �[36;1m#   .adoc  documentation (default)�[0m
 �[36;1m#   .md    wiki content only — plus a transitional allowance for the�[0m
 �[36;1m#          GitHub-mandated files, which are migrating to berrywiki format�[0m
 �[36;1m#   .txt   licence texts�[0m
 �[36;1m#   fixed  names GitHub or convention dictates (CODEOWNERS, funding.yml,�[0m
 �[36;1m#          NOTICE, AUTHORS, MAINTAINERS) keep their form�[0m
 �[36;1mset -uo pipefail�[0m
 �[36;1mfail=0�[0m
 �[36;1m�[0m
 �[36;1m# --- template-repo mode -------------------------------------------�[0m
 �[36;1m# An un-instantiated template legitimately SHIPS {{OWNER}}/{{AUTHOR}}�[0m
 �[36;1m# placeholders and self-references its own template name; judging it�[0m
 �[36;1m# like an instantiated repo is a category error. Detection is explicit�[0m
 �[36;1m# and auditable: the repo name says it is a temp...

---

GitHub Actions: Central Estate CI/CD Audit / estate-audit: ci(secret-scan): rename caller job key secret-scan -> scan (D243)

Conclusion: failure

View job details

##[group]Run # Accepted placements widened per owner ruling 2026-09-19: estate
 �[36;1m# Accepted placements widened per owner ruling 2026-09-19: estate�[0m
 �[36;1m# repos legitimately keep governance docs under docs/ (and GitHub�[0m
 �[36;1m# renders under .github/) — rsr-template-repo itself was failing on�[0m
 �[36;1m# layout, not on substance. Root forms still win (first hit).�[0m
 �[36;1m# Template-repo mode: see below.�[0m
 �[36;1m#�[0m
 �[36;1m# Presence-only checking rewards filler. This gate previously demanded�[0m
 �[36;1m# ARCHITECTURE.md / MAINTAINERS.adoc / GOVERNANCE.md and checked only�[0m
 �[36;1m# that the paths existed — so the cheapest way to pass was to commit�[0m
 �[36;1m# template boilerplate. That happened: an estate repo acquired an�[0m
 �[36;1m# ARCHITECTURE.md describing a directory layout it does not have, a�[0m
 �[36;1m# MAINTAINERS naming a different account as owner, and a mise.toml�[0m
 �[36;1m# pinning `zig = "latest"` against that repo's own .tool-versions.�[0m
 �[36;1m# All three would have passed. So: presence, THEN format, THEN substance.�[0m
 �[36;1m#�[0m
 �[36;1m# Format policy (estate):�[0m
 �[36;1m#   .adoc  documentation (default)�[0m
 �[36;1m#   .md    wiki content only — plus a transitional allowance for the�[0m
 �[36;1m#          GitHub-mandated files, which are migrating to berrywiki format�[0m
 �[36;1m#   .txt   licence texts�[0m
 �[36;1m#   fixed  names GitHub or convention dictates (CODEOWNERS, funding.yml,�[0m
 �[36;1m#          NOTICE, AUTHORS, MAINTAINERS) keep their form�[0m
 �[36;1mset -uo pipefail�[0m
 �[36;1mfail=0�[0m
 �[36;1m�[0m
 �[36;1m# --- template-repo mode -------------------------------------------�[0m
 �[36;1m# An un-instantiated template legitimately SHIPS {{OWNER}}/{{AUTHOR}}�[0m
 �[36;1m# placeholders and self-references its own template name; judging it�[0m
 �[36;1m# like an instantiated repo is a category error. Detection is explicit�[0m
 �[36;1m# and auditable: the repo name says it is a temp...

---

GitHub Actions: CI / 0_docs-baseline.txt: ci(secret-scan): rename caller job key secret-scan -> scan (D243)

Conclusion: failure

View job details

##[group]Run bash ./scripts/validate-docs.sh
 �[36;1mbash ./scripts/validate-docs.sh�[0m
 shell: /usr/bin/bash -e {0}
 ##[endgroup]
 missing required file: SECURITY.md
 missing required file: CONTRIBUTING.md
 missing required file: CODE_OF_CONDUCT.md
 missing required file: CHANGELOG.md
 ##[error]Process completed with exit code 1.

---

GitHub Actions: CI / docs-baseline: ci(secret-scan): rename caller job key secret-scan -> scan (D243)

Conclusion: failure

View job details

##[group]Run bash ./scripts/validate-docs.sh
 �[36;1mbash ./scripts/validate-docs.sh�[0m
 shell: /usr/bin/bash -e {0}
 ##[endgroup]
 missing required file: SECURITY.md
 missing required file: CONTRIBUTING.md
 missing required file: CODE_OF_CONDUCT.md
 missing required file: CHANGELOG.md
 ##[error]Process completed with exit code 1.

🔇 Additional comments (1)

.github/workflows/secret-scanner.yml (1)

21-21: LGTM!

---

📝 Summary

Summary by CodeRabbit

• Chores
  • Updated the naming of an internal security-scanning workflow. Its scanning behavior remains unchanged.
  • No user-facing changes are included in this update.

Walkthrough

The secret-scanner workflow job is renamed from secret-scan to scan. Its reusable workflow reference and inherited secrets remain unchanged.

Changes

Secret scanner workflow

Layer / File(s)	Summary
Rename the workflow job .github/workflows/secret-scanner.yml	The job key changes from secret-scan to scan. The reusable workflow reference and inherited secrets remain unchanged.

Priority: ➖ Normal

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to eae34

The workflow change is limited to its job ID, with triggers and permissions preserved. Confirm the expected check name in the normal workflow run; no concrete merge-blocking issue is established.

Architecture Summary

Architecture risk: 🔵 Low · up to eae34

The changed surface does not map to a changed system, dependency edge, entrypoint, or external dependency.

Changed systems: None identified.

Architecture concerns
No architecture-level concerns identified.

Review details

Before / after behavior

• observed — Modified behavior in .github/workflows/secret-scanner.yml: The workflow job key changes from secret-scan to scan; its reusable workflow reference and inherited secrets remain unchanged.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description explains the change and its purpose, but it does not follow the required template. The Summary, Validation, Risk, and Related sections are missing.	Restructure the description using the required headings. Add a Summary section, complete the Validation checklist, describe operational, security, or governance risk in Risk, and state related issues or discussions in Related. Inclu…

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely describes the main change: renaming the secret-scanner caller job key from secret-scan to scan.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Description check

Resolution

Restructure the description using the required headings. Add a Summary section, complete the Validation checklist, describe operational, security, or governance risk in Risk, and state related issues or discussions in Related. Include the reported actionlint validation under Validation.

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{I’m a rabbit; I inspect the workflow key.
scan now names the job I see.
The reusable call stays in place.
Inherited secrets keep their place.
I hop away with one small change.}

_{Comment @coderabbitai help to get the list of available commands.}