From c495770bd10933ce2e7d58eb6b8ae8c5f2e44af4 Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Fri, 2 Oct 2026 00:25:22 +0100
Subject: [PATCH] ci(secret-scan): canonical estate scanner caller, key scan
 (D243)

Secret-Scan-Floor (D243/D244) requires the context `scan / gitleaks` estate-wide. This repo had no secret-scanner caller. Write the canonical caller: job key `scan`, reusable pinned to standards@74d2f66, push trigger on the default branch `main`.

actionlint: new file clean (findings in previous file: n/a).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0136eszqrQ53Kj7aBH1D4rXK
---
 .github/workflows/secret-scanner.yml | 27 +++++++++++++++++++++++++++
 1 file changed, 27 insertions(+)
 create mode 100644 .github/workflows/secret-scanner.yml

diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml
new file mode 100644
index 0000000..fa6eb1f
--- /dev/null
+++ b/.github/workflows/secret-scanner.yml
@@ -0,0 +1,27 @@
+# SPDX-License-Identifier: MPL-2.0
+# Prevention workflow - scans for hardcoded secrets before they reach main.
+#
+# Calls the estate's shared secret scanner (gitleaks + rust-secrets +
+# shell-secrets). The job key MUST stay `scan`: the estate-wide
+# Secret-Scan-Floor ruleset requires the check context `scan / gitleaks`.
+#
+# No `secrets:` line, deliberately: the reusable references no secrets
+# (gitleaks runs as a checksum-verified binary, not gitleaks-action), so
+# `secrets: inherit` would only hand it every repo and org secret (CWE-250).
+name: Secret Scanner
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  scan:
+    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@74d2f66f575246cf6e313ae7775f44df6e097ff2