ci(secret-scan): canonical estate scanner caller, key scan (D243)

[hyperpolymath]

What

Write the canonical estate secret-scanner caller to .github/workflows/secret-scanner.yml so this repo emits scan / gitleaks, the context the estate Secret-Scan-Floor ruleset (D243/D244) requires. This repo had no secret-scanner caller.

Job key scan; reusable hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@74d2f66f575246cf6e313ae7775f44df6e097ff2; push trigger on main. actionlint clean (previous file findings: n/a). Commit via GraphQL createCommitOnBranch (GitHub-signed, valid: true).

🤖 Generated with Claude Code

https://claude.ai/code/session_0136eszqrQ53Kj7aBH1D4rXK

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: fe8d425f-88fd-43c8-9446-4f1509047fdc

📥 Commits

Reviewing files that changed from the base of the PR and between e4aa5a1 and c495770.

📒 Files selected for processing (1)

• .github/workflows/secret-scanner.yml

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

⏰ Context from checks skipped due to timeout. (6)

• GitHub Check: scan / rust-secrets
• GitHub Check: scan / gitleaks
• GitHub Check: build
• GitHub Check: estate-audit
• GitHub Check: CodeQL Analysis (actions, none)
• GitHub Check: semgrep-cloud-platform/scan

⚠️ CI failures not shown inline (2)

GitHub Actions: Central Estate CI/CD Audit / 0_estate-audit.txt: ci(secret-scan): canonical estate scanner caller, key scan (D243)

Conclusion: failure

View job details

##[group]Run # Accepted placements widened per owner ruling 2026-09-19: estate
 �[36;1m# Accepted placements widened per owner ruling 2026-09-19: estate�[0m
 �[36;1m# repos legitimately keep governance docs under docs/ (and GitHub�[0m
 �[36;1m# renders under .github/) — rsr-template-repo itself was failing on�[0m
 �[36;1m# layout, not on substance. Root forms still win (first hit).�[0m
 �[36;1m# Template-repo mode: see below.�[0m
 �[36;1m#�[0m
 �[36;1m# Presence-only checking rewards filler. This gate previously demanded�[0m
 �[36;1m# ARCHITECTURE.md / MAINTAINERS.adoc / GOVERNANCE.md and checked only�[0m
 �[36;1m# that the paths existed — so the cheapest way to pass was to commit�[0m
 �[36;1m# template boilerplate. That happened: an estate repo acquired an�[0m
 �[36;1m# ARCHITECTURE.md describing a directory layout it does not have, a�[0m
 �[36;1m# MAINTAINERS naming a different account as owner, and a mise.toml�[0m
 �[36;1m# pinning `zig = "latest"` against that repo's own .tool-versions.�[0m
 �[36;1m# All three would have passed. So: presence, THEN format, THEN substance.�[0m
 �[36;1m#�[0m
 �[36;1m# Format policy (estate):�[0m
 �[36;1m#   .adoc  documentation (default)�[0m
 �[36;1m#   .md    wiki content only — plus a transitional allowance for the�[0m
 �[36;1m#          GitHub-mandated files, which are migrating to berrywiki format�[0m
 �[36;1m#   .txt   licence texts�[0m
 �[36;1m#   fixed  names GitHub or convention dictates (CODEOWNERS, funding.yml,�[0m
 �[36;1m#          NOTICE, AUTHORS, MAINTAINERS) keep their form�[0m
 �[36;1mset -uo pipefail�[0m
 �[36;1mfail=0�[0m
 �[36;1m�[0m
 �[36;1m# --- template-repo mode -------------------------------------------�[0m
 �[36;1m# An un-instantiated template legitimately SHIPS {{OWNER}}/{{AUTHOR}}�[0m
 �[36;1m# placeholders and self-references its own template name; judging it�[0m
 �[36;1m# like an instantiated repo is a category error. Detection is explicit�[0m
 �[36;1m# and auditable: the repo name says it is a temp...

---

GitHub Actions: Central Estate CI/CD Audit / estate-audit: ci(secret-scan): canonical estate scanner caller, key scan (D243)

Conclusion: failure

View job details

##[group]Run # Accepted placements widened per owner ruling 2026-09-19: estate
 �[36;1m# Accepted placements widened per owner ruling 2026-09-19: estate�[0m
 �[36;1m# repos legitimately keep governance docs under docs/ (and GitHub�[0m
 �[36;1m# renders under .github/) — rsr-template-repo itself was failing on�[0m
 �[36;1m# layout, not on substance. Root forms still win (first hit).�[0m
 �[36;1m# Template-repo mode: see below.�[0m
 �[36;1m#�[0m
 �[36;1m# Presence-only checking rewards filler. This gate previously demanded�[0m
 �[36;1m# ARCHITECTURE.md / MAINTAINERS.adoc / GOVERNANCE.md and checked only�[0m
 �[36;1m# that the paths existed — so the cheapest way to pass was to commit�[0m
 �[36;1m# template boilerplate. That happened: an estate repo acquired an�[0m
 �[36;1m# ARCHITECTURE.md describing a directory layout it does not have, a�[0m
 �[36;1m# MAINTAINERS naming a different account as owner, and a mise.toml�[0m
 �[36;1m# pinning `zig = "latest"` against that repo's own .tool-versions.�[0m
 �[36;1m# All three would have passed. So: presence, THEN format, THEN substance.�[0m
 �[36;1m#�[0m
 �[36;1m# Format policy (estate):�[0m
 �[36;1m#   .adoc  documentation (default)�[0m
 �[36;1m#   .md    wiki content only — plus a transitional allowance for the�[0m
 �[36;1m#          GitHub-mandated files, which are migrating to berrywiki format�[0m
 �[36;1m#   .txt   licence texts�[0m
 �[36;1m#   fixed  names GitHub or convention dictates (CODEOWNERS, funding.yml,�[0m
 �[36;1m#          NOTICE, AUTHORS, MAINTAINERS) keep their form�[0m
 �[36;1mset -uo pipefail�[0m
 �[36;1mfail=0�[0m
 �[36;1m�[0m
 �[36;1m# --- template-repo mode -------------------------------------------�[0m
 �[36;1m# An un-instantiated template legitimately SHIPS {{OWNER}}/{{AUTHOR}}�[0m
 �[36;1m# placeholders and self-references its own template name; judging it�[0m
 �[36;1m# like an instantiated repo is a category error. Detection is explicit�[0m
 �[36;1m# and auditable: the repo name says it is a temp...

🔇 Additional comments (1)

.github/workflows/secret-scanner.yml (1)

1-27: LGTM!

---

📝 Summary

Summary by CodeRabbit

• Security
  • Secret scanning now runs automatically for pull requests and updates to the main branch. If a scan is already running for the same workflow and branch, it is cancelled before a new one begins. This adds an automated security check to the development process without changing the app’s features or behaviour.

Walkthrough

The pull request adds a GitHub Actions workflow that runs the pinned reusable secret-scanner workflow for pull requests and pushes to main.

Changes

Secret scanning

Layer / File(s)	Summary
Configure the secret-scanner workflow .github/workflows/secret-scanner.yml	The workflow runs on pull requests and pushes to main. It cancels in-progress runs for the same workflow and ref, grants contents: read, and delegates its scan job to a reusable workflow pinned to a commit.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Feature

Merge Risk: ⚪ Minimal · up to c4957

Pull requests run the pinned scanner and produce the required check context; no actionable merge-blocking risk was identified.

Architecture Summary

Architecture risk: 🔵 Low · up to c4957

The changed surface does not map to a changed system, dependency edge, entrypoint, or external dependency.

Changed systems: None identified.

Architecture concerns
No architecture-level concerns identified.

Review details

Before / after behavior

• observed — Modified behavior in .github/workflows/secret-scanner.yml: Adds a workflow with pull-request and main-push triggers, ref-based concurrency with cancellation, read-only contents permission, and a scan job using the reusable workflow at a pinned commit.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the CI secret-scanner workflow and the required job key. It matches the main change.
Description check	✅ Passed	The description explains the new secret-scanner caller, its triggers, reusable workflow, job key, and validation results. It is directly related to the changeset.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit checks the workflow run,
Pull requests start when changes come.
A push to main can start it too,
The pinned scanner checks each view.
With read-only access, it scans along,
Then bounds away when checks are done.}

_{Comment @coderabbitai help to get the list of available commands.}