Repository navigation
Secret Scanner #726
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # This workflow is managed by gh actions-lock. | |
| # SPDX-License-Identifier: MPL-2.0 | |
| # SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk> | |
| # | |
| # secret-scanner.yml — secret scanning, and the source of the required check | |
| # `scan / gitleaks`. | |
| # | |
| # The caller job keeps the id `scan`, and the called workflow keeps its job id | |
| # `gitleaks`, because `main` requires the context `scan / gitleaks` by that exact | |
| # name. Renaming either silently removes the required check and blocks every pull | |
| # request in a way no UI explains. | |
| # | |
| # WHAT CHANGED AND WHY: this used to call | |
| # | |
| # hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@333b06a0… | |
| # | |
| # which this repository's Actions policy refuses at startup (`startup_failure`, | |
| # zero jobs, `referenced_workflows: []`) — so the required check never arrived and | |
| # no pull request could merge. The decisive test is recorded in | |
| # docs/ci/PROMPT-actions-policy.md: re-pinning to the exact SHA a sibling | |
| # repository runs successfully still failed here, so the refusal is repo-scoped. | |
| # | |
| # The call is now to a LOCAL reusable workflow: a byte-for-byte copy of the canon | |
| # file, same pinned and checksum-verified binary, same three jobs, same estate | |
| # baseline, same gate. A `./`-prefixed `uses:` is this repository's own file, so | |
| # no allowlist can refuse it. Restore the estate reference (and delete the | |
| # vendored copy) as soon as the policy permits cross-repository reuse; the check | |
| # name does not change. | |
| # | |
| # Local reusable workflows need no `@ref`, and one cannot be pinned to a commit | |
| # the way a remote one can — the pin here is the `VENDORED-FROM:` SHA recorded in | |
| # the file itself, which `ci-integrity` reads. | |
| name: Secret Scanner | |
| on: | |
| pull_request: | |
| push: | |
| branches: [main] | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| permissions: | |
| actions: read | |
| contents: read | |
| jobs: | |
| scan: | |
| permissions: | |
| contents: read | |
| uses: ./.github/workflows/secret-scanner-vendored.yml |