From 2143afd304ade2fe8b9535a67157dcfca6b7bf23 Mon Sep 17 00:00:00 2001
From: Matthew Jackson <1085847+MattJackson@users.noreply.github.com>
Date: Wed, 2 Sep 2026 18:22:16 -0700
Subject: [PATCH 1/4] ci: make PR Code Security portable (drop prisma-org
 reusables)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The workflow called prisma/.github reusable workflows (secret_detection,
code_scanning) with `secrets: inherit`. Those live in the prisma org and
can't be resolved from tiberius-rs, so PR Code Security failed at startup
on every PR to main.

Replace them with a portable secret scan (gitleaks, free for public
repos, no license needed). Drop the CodeQL code-scanning job: CodeQL has
no Rust support, so it never scanned this crate — Rust security/quality
is already covered by cargo-deny and the clippy gate.
---
 .github/workflows/pr-code-security.yml | 26 +++++++++++++++++++-------
 1 file changed, 19 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/pr-code-security.yml b/.github/workflows/pr-code-security.yml
index fde10666c..45bf0bdef 100644
--- a/.github/workflows/pr-code-security.yml
+++ b/.github/workflows/pr-code-security.yml
@@ -4,13 +4,25 @@ on:
   pull_request:
     branches: [main]
 
+permissions:
+  contents: read
+
 jobs:
   secret-detection:
     name: Secret Detection
-    if: github.event_name == 'pull_request'
-    uses: prisma/.github/.github/workflows/secret_detection.yml@main
-    secrets: inherit
-  code-scanning:
-    name: Code Scanning
-    if: github.event_name == 'pull_request'
-    uses: prisma/.github/.github/workflows/code_scanning.yml@main
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          # Full history so gitleaks can scan the whole PR range.
+          fetch-depth: 0
+          persist-credentials: false
+      - name: gitleaks
+        uses: gitleaks/gitleaks-action@e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e # v3.0.0
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+  # NOTE: the previous `code-scanning` job used GitHub CodeQL, which does not
+  # support Rust — so it never scanned this crate. Rust security/quality is
+  # already covered by `cargo-deny` (advisories/bans/sources in security.yml)
+  # and the strict clippy gate, so CodeQL is intentionally omitted here.

From 47331db33467692cd9dbff423e87b5964b766d3d Mon Sep 17 00:00:00 2001
From: Matthew Jackson <1085847+MattJackson@users.noreply.github.com>
Date: Wed, 2 Sep 2026 18:32:06 -0700
Subject: [PATCH 2/4] ci: run gitleaks CLI directly (action needs org license)

gitleaks-action refuses to run on repos under a GitHub organization
without a paid license key ("[tiberius-rs] is an organization. License
key is required."), so the Secret Detection job failed at startup.

The gitleaks binary itself is MIT-licensed and free. Install a pinned
release, verify its SHA-256, and run `gitleaks git` over the full
history fetched by checkout. No license, no token, no org gating.
---
 .github/workflows/pr-code-security.yml | 22 ++++++++++++++++++----
 1 file changed, 18 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/pr-code-security.yml b/.github/workflows/pr-code-security.yml
index 45bf0bdef..1b628a992 100644
--- a/.github/workflows/pr-code-security.yml
+++ b/.github/workflows/pr-code-security.yml
@@ -14,13 +14,27 @@ jobs:
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
-          # Full history so gitleaks can scan the whole PR range.
+          # Full history so gitleaks can scan every commit in the PR range.
           fetch-depth: 0
           persist-credentials: false
-      - name: gitleaks
-        uses: gitleaks/gitleaks-action@e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e # v3.0.0
+      # We run the gitleaks CLI directly rather than gitleaks-action: the
+      # action wrapper requires a paid license for repos under a GitHub
+      # organization, while the gitleaks binary itself is MIT-licensed and
+      # free. Pinned by version and verified by SHA-256 before use.
+      - name: Install gitleaks
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITLEAKS_VERSION: 8.30.1
+          GITLEAKS_SHA256: 551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb
+        run: |
+          set -euo pipefail
+          url="https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz"
+          curl -sSfL "$url" -o gitleaks.tar.gz
+          echo "${GITLEAKS_SHA256}  gitleaks.tar.gz" | sha256sum -c -
+          tar -xzf gitleaks.tar.gz gitleaks
+          sudo install gitleaks /usr/local/bin/gitleaks
+          gitleaks version
+      - name: Scan git history for secrets
+        run: gitleaks git --no-banner --redact --exit-code 1 .
 
   # NOTE: the previous `code-scanning` job used GitHub CodeQL, which does not
   # support Rust — so it never scanned this crate. Rust security/quality is

From 1039eb0415c47d1d3edfcb5f0ed731da131ad24f Mon Sep 17 00:00:00 2001
From: Matthew Jackson <1085847+MattJackson@users.noreply.github.com>
Date: Wed, 2 Sep 2026 18:43:59 -0700
Subject: [PATCH 3/4] ci: allowlist docker/certs test fixtures in gitleaks
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

gitleaks flagged 4 private keys under docker/certs/ — the self-signed
TLS material that brings up the local SQL Server container the
integration tests connect to over TLS. They are throwaway test
fixtures committed upstream in 2022, not production secrets.

Add a .gitleaks.toml that keeps the full default rule set and allowlists
only that fixture path, so the rest of the tree and history stays
scanned. Verified locally: 0 leaks with the config, 4 without.
---
 .github/workflows/pr-code-security.yml |  2 +-
 .gitleaks.toml                         | 16 ++++++++++++++++
 2 files changed, 17 insertions(+), 1 deletion(-)
 create mode 100644 .gitleaks.toml

diff --git a/.github/workflows/pr-code-security.yml b/.github/workflows/pr-code-security.yml
index 1b628a992..44b11374e 100644
--- a/.github/workflows/pr-code-security.yml
+++ b/.github/workflows/pr-code-security.yml
@@ -34,7 +34,7 @@ jobs:
           sudo install gitleaks /usr/local/bin/gitleaks
           gitleaks version
       - name: Scan git history for secrets
-        run: gitleaks git --no-banner --redact --exit-code 1 .
+        run: gitleaks git --no-banner --redact --exit-code 1 --config .gitleaks.toml .
 
   # NOTE: the previous `code-scanning` job used GitHub CodeQL, which does not
   # support Rust — so it never scanned this crate. Rust security/quality is
diff --git a/.gitleaks.toml b/.gitleaks.toml
new file mode 100644
index 000000000..dfc666714
--- /dev/null
+++ b/.gitleaks.toml
@@ -0,0 +1,16 @@
+# gitleaks configuration for the PR Code Security secret scan.
+#
+# Start from gitleaks' full default rule set, then allowlist only the
+# self-signed TLS material under `docker/certs/`. Those keys and
+# certificates exist solely to bring up the local SQL Server container the
+# integration tests connect to over TLS; they are throwaway test fixtures
+# (committed upstream in 2022), never production secrets. Everything else
+# in the tree and its history is still scanned.
+[extend]
+useDefault = true
+
+[allowlist]
+description = "Self-signed TLS test fixtures for the local integration-test SQL Server container"
+paths = [
+    '''docker/certs/.*''',
+]

From b448f43f46349c54bcf36db3cc6470de6154ea8d Mon Sep 17 00:00:00 2001
From: Matthew Jackson <1085847+MattJackson@users.noreply.github.com>
Date: Thu, 3 Sep 2026 07:55:48 -0700
Subject: [PATCH 4/4] ci: address review nits on the portable secret scan

- gitleaks.toml: trim the header comment; drop the misleading "upstream 2022" note
- pr-code-security.yml: remove the CodeQL-removal comment (history narration)
---
 .github/workflows/pr-code-security.yml |  5 -----
 .gitleaks.toml                         | 10 ++--------
 2 files changed, 2 insertions(+), 13 deletions(-)

diff --git a/.github/workflows/pr-code-security.yml b/.github/workflows/pr-code-security.yml
index 44b11374e..3448776aa 100644
--- a/.github/workflows/pr-code-security.yml
+++ b/.github/workflows/pr-code-security.yml
@@ -35,8 +35,3 @@ jobs:
           gitleaks version
       - name: Scan git history for secrets
         run: gitleaks git --no-banner --redact --exit-code 1 --config .gitleaks.toml .
-
-  # NOTE: the previous `code-scanning` job used GitHub CodeQL, which does not
-  # support Rust — so it never scanned this crate. Rust security/quality is
-  # already covered by `cargo-deny` (advisories/bans/sources in security.yml)
-  # and the strict clippy gate, so CodeQL is intentionally omitted here.
diff --git a/.gitleaks.toml b/.gitleaks.toml
index dfc666714..3439483e1 100644
--- a/.gitleaks.toml
+++ b/.gitleaks.toml
@@ -1,11 +1,5 @@
-# gitleaks configuration for the PR Code Security secret scan.
-#
-# Start from gitleaks' full default rule set, then allowlist only the
-# self-signed TLS material under `docker/certs/`. Those keys and
-# certificates exist solely to bring up the local SQL Server container the
-# integration tests connect to over TLS; they are throwaway test fixtures
-# (committed upstream in 2022), never production secrets. Everything else
-# in the tree and its history is still scanned.
+# gitleaks config for the PR secret scan: full default rule set, with the
+# self-signed TLS test fixtures under docker/certs/ allowlisted.
 [extend]
 useDefault = true