From 4476eb61ad6a0fc14c7b6c9ea5900d4b43853498 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Fri, 2 Oct 2026 00:39:09 +0100 Subject: [PATCH 1/2] ci(secret-scan): canonical estate scanner caller, key scan (D243) Secret-Scan-Floor (D243/D244) requires the context `scan / gitleaks` estate-wide. The previous inline scanner jobs emitted bare contexts (e.g. `gitleaks`) that cannot satisfy the floor; the reusable deliberately drops TruffleHog as redundant with gitleaks. Write the canonical caller: job key `scan`, reusable pinned to standards@74d2f66, push trigger on the default branch `main`. actionlint: new file clean (findings in previous file: 0). Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_0136eszqrQ53Kj7aBH1D4rXK --- .github/workflows/secret-scanner.yml | 77 ++++------------------------ 1 file changed, 11 insertions(+), 66 deletions(-) diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index 2282545..fa6eb1f 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -1,6 +1,13 @@ # SPDX-License-Identifier: MPL-2.0 -# This workflow is managed by gh actions-lock. -# Prevention workflow - scans for hardcoded secrets before they reach main +# Prevention workflow - scans for hardcoded secrets before they reach main. +# +# Calls the estate's shared secret scanner (gitleaks + rust-secrets + +# shell-secrets). The job key MUST stay `scan`: the estate-wide +# Secret-Scan-Floor ruleset requires the check context `scan / gitleaks`. +# +# No `secrets:` line, deliberately: the reusable references no secrets +# (gitleaks runs as a checksum-verified binary, not gitleaks-action), so +# `secrets: inherit` would only hand it every repo and org secret (CWE-250). name: Secret Scanner on: @@ -8,10 +15,6 @@ on: push: branches: [main] -# Estate guardrail: cancel superseded runs so re-pushes / rebased PR -# updates do not pile up queued runs against the shared account-wide -# Actions concurrency pool. Applied only to read-only check workflows -# (no publish/mutation), so cancelling a superseded run is always safe. concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true @@ -20,63 +23,5 @@ permissions: contents: read jobs: - trufflehog: - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4 - with: - fetch-depth: 0 # Full history for scanning - - - name: TruffleHog Secret Scan - uses: trufflesecurity/trufflehog@6c05c4a00b91aa542267d8e32a8254774799d68d # v3 - with: - # The v3 action injects --fail automatically on pull_request events. - # Passing --fail here triggers "flag 'fail' cannot be repeated". - extra_args: --only-verified - - gitleaks: - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4 - with: - fetch-depth: 0 - - - name: Gitleaks Secret Scan - uses: gitleaks/gitleaks-action@ff98106e4c7b2bc287b24eaf42907196329070c7 # v2 - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - - # Rust-specific: Check for hardcoded crypto values - rust-secrets: - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4 - - - name: Check for hardcoded secrets in Rust - run: | - if ! find . -name Cargo.toml -not -path './target/*' -print -quit | grep -q .; then - echo 'No Cargo.toml found — skipping Rust secrets check' - exit 0 - fi - # Patterns that suggest hardcoded secrets - PATTERNS=( - 'const.*SECRET.*=.*"' - 'const.*KEY.*=.*"[a-zA-Z0-9]{16,}"' - 'const.*TOKEN.*=.*"' - 'let.*api_key.*=.*"' - 'HMAC.*"[a-fA-F0-9]{32,}"' - 'password.*=.*"[^"]+"' - ) - - found=0 - for pattern in "${PATTERNS[@]}"; do - if grep -rn --include="*.rs" -E "$pattern" src/; then - echo "WARNING: Potential hardcoded secret found matching: $pattern" - found=1 - fi - done - - if [ $found -eq 1 ]; then - echo "::error::Potential hardcoded secrets detected. Use environment variables instead." - exit 1 - fi + scan: + uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@74d2f66f575246cf6e313ae7775f44df6e097ff2 From 480be1153a63c950198db20ff1b712712d5a331f Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Fri, 2 Oct 2026 00:39:30 +0100 Subject: [PATCH 2/2] ci(actions-lock): empty the secret-scanner.yml key for the reusable caller The caller's only uses: is a job-level reusable workflow, which actions.lock does not track; the stale step entries left from the inline scanner made GitHub refuse to start the workflow (startup_failure, jobs=0). Verified: standards check-actions-lock-gate.sh rc=0 and gh actions-lock --no-fix valid=true. gh actions-lock does not rewrite this key itself (D283). Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_0136eszqrQ53Kj7aBH1D4rXK --- .github/workflows/actions.lock | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock index f85babd..0cfe308 100644 --- a/.github/workflows/actions.lock +++ b/.github/workflows/actions.lock @@ -21,10 +21,7 @@ workflows: - 'peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697' '.github/workflows/push-email-notify.yml': - 'hyperpolymath/smtp-notify-action@ede1191ef6ff3ac02c4f4d9efdf837ee517e11d7' - '.github/workflows/secret-scanner.yml': - - 'actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd' - - 'gitleaks/gitleaks-action@ff98106e4c7b2bc287b24eaf42907196329070c7' - - 'trufflesecurity/trufflehog@6c05c4a00b91aa542267d8e32a8254774799d68d' + '.github/workflows/secret-scanner.yml': [] '.github/workflows/workflow-linter.yml': - 'actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11' dependencies: