Move to maintain-kit v1.0.0 and its secret-scan workflow

.claude/settings.json

@@ -8,7 +8,6 @@
       "Bash(pnpm format:*)",
       "Bash(pnpm format:check:*)",
       "Bash(pnpm test:*)",
-      "Bash(pnpm secrets:scan:*)",
       "Bash(pnpm knip:*)",
       "Bash(pnpm --filter:*)",
       "Bash(gh api:*)"

.github/workflows/checks.yml

@@ -49,23 +49,12 @@ jobs:
           TASK: ${{ matrix.task }}
         run: pnpm "$TASK"
 
-  secrets-scan:
-    name: secrets-scan
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
+  # gitleaks over the full git history, at the version pinned in the reusable
+  # workflow. It reads `.gitleaks.toml` here if one is added.
+  secret-scan:
     permissions:
       contents: read
-    steps:
-      # Full history: gitleaks scans every commit, not just the checked-out tree.
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
-          fetch-depth: 0
-
-      # Same script as `pnpm secrets:scan`; runs the pinned gitleaks Docker
-      # image, so no pnpm/Node setup is needed.
-      - name: Scan for secrets
-        run: sh .github/scripts/secrets-scan.sh
+    uses: valuecodes/maintain-kit/.github/workflows/secret-scan.yml@e5bf1d24a413d9312cd2051c39ef44ddd9358be5 # v1.0.0
 
   codeql:
     name: codeql (${{ matrix.language }})
@@ -105,4 +94,4 @@ jobs:
   workflow-lint:
     permissions:
       contents: read
-    uses: valuecodes/automation/.github/workflows/workflow-lint.yml@faff74cb5d78478b0bd271db840916706dc2cce0 # v0.3.1
+    uses: valuecodes/maintain-kit/.github/workflows/workflow-lint.yml@e5bf1d24a413d9312cd2051c39ef44ddd9358be5 # v1.0.0

.github/workflows/maintain-kit-dashboard.yml

@@ -0,0 +1,19 @@
+name: Maintain-kit dashboard
+
+on:
+  schedule:
+    # Daily. An off-peak minute avoids the top-of-the-hour queue.
+    - cron: "41 5 * * *"
+  workflow_dispatch:
+
+permissions: {}
+
+jobs:
+  # Keeps one issue listing due catalog, pnpm, Node.js and audit updates. It
+  # never changes code. A called workflow cannot raise the caller's token, so
+  # the job grants it here.
+  maintain-kit-dashboard:
+    permissions:
+      contents: read
+      issues: write
+    uses: valuecodes/maintain-kit/.github/workflows/dashboard.yml@e5bf1d24a413d9312cd2051c39ef44ddd9358be5 # v1.0.0

AGENTS.md

@@ -28,7 +28,7 @@ Guidelines for AI agents and contributors working in this Turborepo monorepo.
 | url-validator | `@repo/url-validator` | Safety policy checks for user-supplied URLs       |
 
 CI helpers are not workspaces: the composite setup action lives in
-`.github/actions/setup/` and the gitleaks script in `.github/scripts/`.
+`.github/actions/setup/`.
 
 Apps may import packages; packages must never import apps. oxlint bans `../`
 imports and deep `@repo/*/src` imports: import other workspaces by package name,
@@ -51,7 +51,6 @@ pnpm test                        # turbo run test
 pnpm build                       # turbo run build
 pnpm format                      # oxfmt, writes in place
 pnpm format:check                # oxfmt --check (no writes)
-pnpm secrets:scan                # gitleaks over the full git history
 pnpm clean                       # turbo run clean
 
 pnpm --filter @repo/operator set-webhook <url> [-- --prod]
@@ -66,15 +65,17 @@ imports.
 
 There is no post-edit formatting hook: run `pnpm format` yourself before committing.
 
-`secrets:scan` runs gitleaks (`.github/scripts/secrets-scan.sh`, version pinned
-there) using a local `gitleaks` v8.19+ if one is on PATH, otherwise the pinned Docker image.
-It exits 0 when clean and 1 when it finds a leak.
+There are no git hooks. CI scans the full git history for secrets with the gitleaks
+version pinned in `secret-scan.yml` from `valuecodes/maintain-kit`, so this repo holds
+no gitleaks pin; a local `gitleaks git --staged` (gitleaks v8.19+) does the same for
+staged changes before a commit.
 
 CI checks are defined once, in the reusable `.github/workflows/checks.yml`: typecheck,
-lint, knip, format:check, test, secrets-scan, CodeQL code scanning
-(`javascript-typescript`) and workflow-lint. workflow-lint calls the reusable workflow
-from `valuecodes/automation`: actionlint (with shellcheck) and zizmor over the workflow
-and action files. Each tool reads `.github/actionlint.yaml` / `zizmor.yml` if added. The
+lint, knip, format:check, test, CodeQL code scanning (`javascript-typescript`),
+secret-scan and workflow-lint. secret-scan and workflow-lint call the reusable workflows
+from `valuecodes/maintain-kit`: gitleaks over the full git history, and actionlint (with
+shellcheck) and zizmor over the workflow and action files. Each tool reads
+`.github/actionlint.yaml` / `zizmor.yml` if added. The
 typecheck and test jobs restore Turbo's `.turbo` cache from the previous run of the same
 task, so unchanged packages replay instead of rerunning. Two workflows call it:
 
@@ -89,18 +90,16 @@ D1 migrations are a separate workflow (`migrations.yml`): it runs on push to `ma
 Dependabot (`.github/dependabot.yml`) bumps the SHA-pinned actions and reusable workflows
 monthly in one grouped PR; npm dependencies are updated by hand.
 
-`maintenance-dashboard.yml` calls the maintenance dashboard workflow from
-`valuecodes/automation` daily.
-It keeps one issue, **Maintenance dashboard** (label `maintenance-dashboard`), listing
-what is due: `catalog:` updates, pnpm (`packageManager`), gitleaks (`GITLEAKS_VERSION`
-in the secrets-scan script), Node.js (`.nvmrc`) and `pnpm audit` findings. Like
+`maintain-kit-dashboard.yml` calls the dashboard workflow from
+`valuecodes/maintain-kit` daily.
+It keeps one issue, **Maintenance dashboard** (label `maintain-kit-dashboard`), listing
+what is due: `catalog:` updates, pnpm (`packageManager`), Node.js (`.nvmrc`) and
+`pnpm audit` findings. Like
 `minimumReleaseAge`, a release shows up only once it is 14 days old; a Node.js security
 release shows up right away and is flagged. It never opens PRs or commits; doing the
 updates stays manual. For a Node.js bump, change only `.nvmrc` (the one place that
-holds the exact version). If `GITLEAKS_VERSION` moves out of
-`.github/scripts/secrets-scan.sh`, pass the new path as the `gitleaks-script` input.
-The dashboard and workflow-lint callers pin the same `valuecodes/automation` commit, so
-bump them together.
+holds the exact version). The dashboard, secret-scan and workflow-lint callers pin the
+same `valuecodes/maintain-kit` commit, so bump them together.
 
 ---
 

README.md

@@ -37,7 +37,7 @@ packages/
   telegram/         # Telegram Bot API client
   typescript/       # Shared TypeScript config
   url-validator/    # Safety policy checks for user-supplied URLs
-.github/            # CI workflow, composite setup action, secrets-scan script
+.github/            # CI workflows, composite setup action
 .oxlintrc.json      # Single root lint config
 .oxfmtrc.jsonc      # Single root format config
 ```
@@ -73,7 +73,6 @@ pnpm typecheck        # type checking
 pnpm lint             # oxlint
 pnpm knip             # unused files, exports and dependencies
 pnpm test             # run tests
-pnpm secrets:scan     # gitleaks over git history
 pnpm format:check     # check formatting
 pnpm format           # fix formatting
 ```
@@ -87,10 +86,15 @@ to tunnel to your local worker. See
 ## CI and repo settings
 
 The checks live in `.github/workflows/checks.yml`: typecheck, lint, knip, format:check,
-test, a gitleaks secret scan, CodeQL and actionlint + zizmor over the workflow files.
-`feature.yml` runs them on PRs and fans them into `all-passed`; `main.yml` runs them on
-push to `main`, then the `deploy` job deploys the workers. GitHub settings this relies
-on:
+test, CodeQL, a gitleaks secret scan over the full git history and actionlint + zizmor
+over the workflow files; the last two run through the reusable `secret-scan.yml` and
+`workflow-lint.yml` from `valuecodes/maintain-kit`. `feature.yml` runs them on PRs and
+fans them into `all-passed`; `main.yml` runs them on push to `main`, then the `deploy`
+job deploys the workers. There are no git hooks: to scan staged changes before a
+commit, run `gitleaks git --staged` with gitleaks v8.19+ (`brew install gitleaks` on
+macOS, Linux and WSL, or unpack the `linux_x64` tarball from the
+[releases page](https://github.com/gitleaks/gitleaks/releases) into a directory on
+PATH such as `~/.local/bin`). GitHub settings this relies on:
 
 1. **Rules → Rulesets**: the `main` ruleset requires a pull request and the
    `all-passed` status check, the only one to list.
@@ -100,5 +104,5 @@ on:
    CodeQL uploads from `checks.yml`.
 4. **Code security → Dependabot**: **alerts** on, **security updates** off.
    `.github/dependabot.yml` only bumps the SHA-pinned GitHub Actions monthly.
-5. **Issues**: run the `Maintenance dashboard` workflow once, then pin the
+5. **Issues**: run the `Maintain-kit dashboard` workflow once, then pin the
    **Maintenance dashboard** issue it creates.

package.json

@@ -18,7 +18,6 @@
     "format": "oxfmt",
     "format:check": "oxfmt --check",
     "knip": "knip",
-    "secrets:scan": "sh .github/scripts/secrets-scan.sh",
     "clean": "turbo run clean"
   },
   "devDependencies": {