ci(secret-scan): rename caller job key secret-scan -> scan (D243)

[hyperpolymath]

What

Rename the secret-scanner caller job key secret-scan → scan in .github/workflows/secret-scanner.yml, so the check context becomes scan / gitleaks — the context the estate Secret-Scan-Floor ruleset (D243/D244) requires. One-line change; reusable pin, triggers and permissions unchanged. actionlint output is identical before and after.

Commit created via GraphQL createCommitOnBranch (GitHub-signed, signature valid: true).

🤖 Generated with Claude Code

https://claude.ai/code/session_0136eszqrQ53Kj7aBH1D4rXK

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 99cec9ea-b095-4948-b81f-fb491e66abd9

📥 Commits

Reviewing files that changed from the base of the PR and between 8443ed2 and 0799825.

📒 Files selected for processing (1)

• .github/workflows/secret-scanner.yml

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

⏰ Context from checks skipped due to timeout. (4)

• GitHub Check: scan / gitleaks
• GitHub Check: scan / rust-secrets
• GitHub Check: analyze (actions, none)
• GitHub Check: semgrep-cloud-platform/scan

⚠️ CI failures not shown inline (2)

GitHub Actions: Rust CI / 0_Build + test + clippy + fmt.txt: ci(secret-scan): rename caller job key secret-scan -> scan (D243)

Conclusion: failure

View job details

##[group]Run bash scripts/check-spdx.sh
 �[36;1mbash scripts/check-spdx.sh�[0m
 shell: /usr/bin/bash -e {0}
 ##[endgroup]
   MISSING MPL-2.0 (code/config/script/state): .editorconfig
   MISSING MPL-2.0 (code/config/script/state): .gitattributes
   MISSING MPL-2.0 (code/config/script/state): .github/CODEOWNERS
   MISSING CC-BY-SA-4.0 (prose): .github/CONTRIBUTING.md
   MISSING MPL-2.0 (code/config/script/state): .github/funding.yml
   MISSING MPL-2.0 (code/config/script/state): .github/label-classifier.json
   MISSING MPL-2.0 (code/config/script/state): .github/labels.json
   MISSING CC-BY-SA-4.0 (prose): ARCHITECTURE.adoc
   MISSING CC-BY-SA-4.0 (prose): CHANGELOG.adoc
   MISSING CC-BY-SA-4.0 (prose): CODE_OF_CONDUCT.adoc
   MISSING CC-BY-SA-4.0 (prose): GOVERNANCE.adoc
   MISSING MPL-2.0 (code/config/script/state): MAINTAINERS
   MISSING CC-BY-SA-4.0 (prose): README.adoc
   MISSING CC-BY-SA-4.0 (prose): SECURITY.adoc
   MISSING MPL-2.0 (code/config/script/state): mise.toml
 SPDX licence invariant: FAIL (see above).
 Fix one of:
   * add the correct SPDX header to the file, OR
   * if the file is third-party / generated / test data, add it to the
     excluded set in scripts/check-spdx.sh AND
     .machine_readable/licensing-policy.toml — never relicense others' code.
 ##[error]Process completed with exit code 1.

---

GitHub Actions: Rust CI / Build + test + clippy + fmt: ci(secret-scan): rename caller job key secret-scan -> scan (D243)

Conclusion: failure

View job details

##[group]Run bash scripts/check-spdx.sh
 �[36;1mbash scripts/check-spdx.sh�[0m
 shell: /usr/bin/bash -e {0}
 ##[endgroup]
   MISSING MPL-2.0 (code/config/script/state): .editorconfig
   MISSING MPL-2.0 (code/config/script/state): .gitattributes
   MISSING MPL-2.0 (code/config/script/state): .github/CODEOWNERS
   MISSING CC-BY-SA-4.0 (prose): .github/CONTRIBUTING.md
   MISSING MPL-2.0 (code/config/script/state): .github/funding.yml
   MISSING MPL-2.0 (code/config/script/state): .github/label-classifier.json
   MISSING MPL-2.0 (code/config/script/state): .github/labels.json
   MISSING CC-BY-SA-4.0 (prose): ARCHITECTURE.adoc
   MISSING CC-BY-SA-4.0 (prose): CHANGELOG.adoc
   MISSING CC-BY-SA-4.0 (prose): CODE_OF_CONDUCT.adoc
   MISSING CC-BY-SA-4.0 (prose): GOVERNANCE.adoc
   MISSING MPL-2.0 (code/config/script/state): MAINTAINERS
   MISSING CC-BY-SA-4.0 (prose): README.adoc
   MISSING CC-BY-SA-4.0 (prose): SECURITY.adoc
   MISSING MPL-2.0 (code/config/script/state): mise.toml
 SPDX licence invariant: FAIL (see above).
 Fix one of:
   * add the correct SPDX header to the file, OR
   * if the file is third-party / generated / test data, add it to the
     excluded set in scripts/check-spdx.sh AND
     .machine_readable/licensing-policy.toml — never relicense others' code.
 ##[error]Process completed with exit code 1.

🔇 Additional comments (1)

.github/workflows/secret-scanner.yml (1)

18-18: 🎯 Functional Correctness

No stale secret-scan references exist in .github/workflows/secret-scanner.yml. The workflow defines the job as scan and contains no needs: or needs.secret-scan entries.

---

📝 Summary

Summary by CodeRabbit

• Chores
  • Updated internal automation configuration. This change does not affect product features or the experience available to end-users. No changes to product functionality are included in this release.

Walkthrough

The secret scanner workflow job key changes from secret-scan to scan. The reusable workflow and inherited secrets remain unchanged.

Changes

Secret scanner workflow

Layer / File(s)	Summary
Rename the workflow job .github/workflows/secret-scanner.yml	The job key changes from secret-scan to scan. The reusable workflow and inherited secrets remain unchanged.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Bug fix

Suggested reviewers: metadatastician

Merge Risk: ⚪ Minimal · up to 07998

The workflow change is limited to the requested job rename, with no repository-controlled breakage identified.

Architecture Summary

Architecture risk: 🔵 Low · up to 07998

The changed surface does not map to a changed system, dependency edge, entrypoint, or external dependency.

Changed systems: None identified.

Architecture concerns
No architecture-level concerns identified.

Review details

Before / after behavior

• observed — Modified behavior in .github/workflows/secret-scanner.yml: The workflow job key changes from secret-scan to scan; its reusable workflow and inherited secrets remain unchanged.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly states the CI change: it renames the secret-scan caller job key to scan.
Description check	✅ Passed	The description directly explains the job-key rename, the required scan / gitleaks context, and the unchanged workflow settings.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit checks the scanner’s name
“scan” now marks its workflow frame
The secrets stay as they were
The workflow call stays there
Then hops away without a claim}

_{Comment @coderabbitai help to get the list of available commands.}