[jasper9]

GATOR-3555: harden reusable-secrets-check.yml (pinned gitleaks, SHA-pinned checkout, no persisted token)

Why: a supply-chain review (Holdfast GATOR-3553/3555) found that this workflow:

• downloaded gitleaks releases/latest with no checksum, resolved through an API call that carried the job token;
• ran actions/checkout@v4 and upload-sarif@v4 by mutable tags;
• left the GITHUB_TOKEN in .git/config, where the downloaded binary could read it.

A replaced upstream release could have exfiltrated a caller's private source, or silently passed the scan.

What changes in reusable-secrets-check.yml:

• gitleaks pinned to v8.30.1: the same version releases/latest gives today, so callers run the same binary. It's verified against a hardcoded sha256 (551f6fc8…70eb); three sources agree: the release checksums file, an independent download, and GitHub's asset digest.
  • sha256sum --check --strict runs before anything is extracted or added to PATH, under set -euo pipefail.
  • The install goes to $RUNNER_TEMP: no API call, no token, no sudo. curl uses --proto '=https' --proto-redir '=https'.
• actions/checkout is pinned to 3d3c42e5… # v7.0.1, with persist-credentials: false. The job is capped at permissions: contents: read.
• The SARIF upload is removed. No caller grants this job security-events: write, so it failed on every run ("Resource not accessible by integration"), hidden by continue-on-error. Removing it changes no job result and saves about 44s.
• gitleaks detect flags are byte-identical, so findings and exit codes are unchanged for callers.

New self-test-secrets-check.yml runs on PRs and pushes touching either file:

• lint: fails on a releases/latest lookup, any uses: not pinned to a 40-hex SHA, checkout without persist-credentials: false, a missing hardcoded GITLEAKS_SHA256, or any token/secrets reference. It's red against the current main (7 violations) and green here.
• fail-closed: runs the real install script with a wrong sha256 and asserts it fails AFTER downloading, installs nothing and adds nothing to PATH. Then it runs the real script and asserts gitleaks version = 8.30.1.
• smoke: calls the reusable on this repo.

Callers: 15 repos call this @main. There are no new inputs or secrets, the trigger is unchanged and the flags are identical, so callers see no behaviour change beyond the hardening. tooth pins a commit and will bump to the new tag. bayou pins an older commit.

Merge order: please merge this before Dependabot #6 (checkout 4 → 7), which touches the same file, and let #6 rebase.

Before merging: a throwaway tooth PR runs this branch's head SHA. It must be green clean, and red with a freshly generated fake key. Then v1.0.1 is tagged on this PR's merge commit.

Reviews:

• Architect, Security and QA APPROVE. actionlint 1.7.7 is clean on both files.
• QA: 11 mutations. Lint catches 8, fail-closed catches the hash-check removal, and 1 is a correct pass.

🤖 Generated with Claude Code

https://claude.ai/code/session_01ApgRQf2Vm31kdXJgRarULJ