From ea595c82e41b04e11ed719b5f26898d9c156e9ce Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Fri, 2 Oct 2026 00:39:42 +0100 Subject: [PATCH 1/2] ci(secret-scan): canonical estate scanner caller, key scan (D243) Secret-Scan-Floor (D243/D244) requires the context `scan / gitleaks` estate-wide. The previous inline scanner jobs emitted bare contexts (e.g. `gitleaks`) that cannot satisfy the floor; the reusable deliberately drops TruffleHog as redundant with gitleaks. Write the canonical caller: job key `scan`, reusable pinned to standards@74d2f66, push trigger on the default branch `main`. actionlint: new file clean (findings in previous file: 0). Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_0136eszqrQ53Kj7aBH1D4rXK --- .github/workflows/secret-scanner.yml | 79 ++++------------------------ 1 file changed, 11 insertions(+), 68 deletions(-) diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index 23a668d..fa6eb1f 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -1,8 +1,13 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 -# This workflow is managed by gh actions-lock. -# This workflow is managed by gh actions-lock. -# Prevention workflow - scans for hardcoded secrets before they reach main +# Prevention workflow - scans for hardcoded secrets before they reach main. +# +# Calls the estate's shared secret scanner (gitleaks + rust-secrets + +# shell-secrets). The job key MUST stay `scan`: the estate-wide +# Secret-Scan-Floor ruleset requires the check context `scan / gitleaks`. +# +# No `secrets:` line, deliberately: the reusable references no secrets +# (gitleaks runs as a checksum-verified binary, not gitleaks-action), so +# `secrets: inherit` would only hand it every repo and org secret (CWE-250). name: Secret Scanner on: @@ -10,10 +15,6 @@ on: push: branches: [main] -# Estate guardrail: cancel superseded runs so re-pushes / rebased PR -# updates do not pile up queued runs against the shared account-wide -# Actions concurrency pool. Applied only to read-only check workflows -# (no publish/mutation), so cancelling a superseded run is always safe. concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true @@ -22,63 +23,5 @@ permissions: contents: read jobs: - trufflehog: - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v6.0.2 - with: - fetch-depth: 0 # Full history for scanning - - - name: TruffleHog Secret Scan - uses: trufflesecurity/trufflehog@v3.93.8 - with: - # The v3 action injects --fail automatically on pull_request events. - # Passing --fail here triggers "flag 'fail' cannot be repeated". - extra_args: --only-verified - - gitleaks: - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v6.0.2 - with: - fetch-depth: 0 - - - name: Gitleaks Secret Scan - uses: gitleaks/gitleaks-action@v2.3.9 - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - - # Rust-specific: Check for hardcoded crypto values - rust-secrets: - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v6.0.2 - - - name: Check for hardcoded secrets in Rust - run: | - if ! find . -name Cargo.toml -not -path './target/*' -print -quit | grep -q .; then - echo 'No Cargo.toml found — skipping Rust secrets check' - exit 0 - fi - # Patterns that suggest hardcoded secrets - PATTERNS=( - 'const.*SECRET.*=.*"' - 'const.*KEY.*=.*"[a-zA-Z0-9]{16,}"' - 'const.*TOKEN.*=.*"' - 'let.*api_key.*=.*"' - 'HMAC.*"[a-fA-F0-9]{32,}"' - 'password.*=.*"[^"]+"' - ) - - found=0 - for pattern in "${PATTERNS[@]}"; do - if grep -rn --include="*.rs" -E "$pattern" src/; then - echo "WARNING: Potential hardcoded secret found matching: $pattern" - found=1 - fi - done - - if [ $found -eq 1 ]; then - echo "::error::Potential hardcoded secrets detected. Use environment variables instead." - exit 1 - fi + scan: + uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@74d2f66f575246cf6e313ae7775f44df6e097ff2 From 5e920c20368b3df393fdbec3cea9d2ec161a1725 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Fri, 2 Oct 2026 00:40:09 +0100 Subject: [PATCH 2/2] ci(actions-lock): empty the secret-scanner.yml key for the reusable caller The caller's only uses: is a job-level reusable workflow, which actions.lock does not track; the stale step entries left from the inline scanner made GitHub refuse to start the workflow (startup_failure, jobs=0). Verified: standards check-actions-lock-gate.sh rc=0 and gh actions-lock --no-fix valid=true. gh actions-lock does not rewrite this key itself (D283). Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_0136eszqrQ53Kj7aBH1D4rXK --- .github/workflows/actions.lock | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock index 04c24b5..3592964 100644 --- a/.github/workflows/actions.lock +++ b/.github/workflows/actions.lock @@ -27,10 +27,7 @@ workflows: '.github/workflows/push-email-notify.yml': - 'hyperpolymath/smtp-notify-action@v0.2.0' '.github/workflows/scorecard.yml': [] - '.github/workflows/secret-scanner.yml': - - 'actions/checkout@v6.0.2' - - 'gitleaks/gitleaks-action@v2.3.9' - - 'trufflesecurity/trufflehog@v3.93.8' + '.github/workflows/secret-scanner.yml': [] '.github/workflows/workflow-linter.yml': - 'actions/checkout@v4.1.1' dependencies: