ci(secret-scan): rename caller job key secret-scan -> scan (D243) by hyperpolymath · Pull Request #91 · hyperpolymath/dicti0nary-attack

hyperpolymath · 2026-10-01T12:20:44Z

What

Rename the secret-scanner caller job key secret-scan → scan in .github/workflows/secret-scanner.yml, so the check context becomes scan / gitleaks — the context the estate Secret-Scan-Floor ruleset (D243/D244) requires. One-line change; reusable pin, triggers and permissions unchanged. actionlint output is identical before and after.

Commit created via GraphQL createCommitOnBranch (GitHub-signed, signature valid: true).

🤖 Generated with Claude Code

https://claude.ai/code/session_0136eszqrQ53Kj7aBH1D4rXK

Secret-Scan-Floor (D243/D244) requires the context `scan / gitleaks` estate-wide. The caller job key here was `secret-scan`, which emits `secret-scan / gitleaks` and can never satisfy the floor. Rename only; the reusable pin and permissions are unchanged. actionlint output identical before and after. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0136eszqrQ53Kj7aBH1D4rXK

coderabbitai · 2026-10-01T12:20:57Z

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 2d83f365-076e-4e06-aded-fa8325e45779

📥 Commits

Reviewing files that changed from the base of the PR and between 56c81bd and d6b9b22.

📒 Files selected for processing (1)

.github/workflows/secret-scanner.yml

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

⏰ Context from checks skipped due to timeout. (25)

GitHub Check: governance / Trusted-base reduction policy
GitHub Check: governance / Debt ratchet
GitHub Check: governance / Actions lockfile verify
GitHub Check: governance / Guix packaging policy (Nix retired)
GitHub Check: governance / Exemption ratchet
GitHub Check: governance / Live Actions policy (credentialed advisory)
GitHub Check: governance / Security policy checks
GitHub Check: governance / Allowlist Preflight
GitHub Check: governance / Licence consistency
GitHub Check: hypatia / Hypatia Neurosymbolic Analysis
GitHub Check: governance / Check Workflow Staleness
GitHub Check: governance / Workflow security linter
GitHub Check: governance / Well-Known (RFC 9116 + RSR)
GitHub Check: governance / Code quality + docs
GitHub Check: governance / Language / package anti-pattern policy
GitHub Check: rust-ci / Detect Cargo.toml
GitHub Check: scan / gitleaks
GitHub Check: Test (3.12)
GitHub Check: Test (3.11)
GitHub Check: Test (3.10)
GitHub Check: Security Scan
GitHub Check: Build Documentation
GitHub Check: analyze (javascript-typescript, none)
GitHub Check: analyze (cpp, none)
GitHub Check: semgrep-cloud-platform/scan

⚠️ CI failures not shown inline (24)

GitHub Actions: CI/CD Pipeline / 2_Test (3.11).txt: ci(secret-scan): rename caller job key secret-scan -> scan (D243)

Conclusion: failure

View job details

##[group]Run python -m pip install --upgrade pip
 �[36;1mpython -m pip install --upgrade pip�[0m
 �[36;1mpip install -r requirements.txt�[0m
 �[36;1mpip install -e .�[0m
 shell: /usr/bin/bash -e {0}
 env:
   pythonLocation: /opt/hostedtoolcache/Python/3.11.16/x64
   PKG_CONFIG_PATH: /opt/hostedtoolcache/Python/3.11.16/x64/lib/pkgconfig
   Python_ROOT_DIR: /opt/hostedtoolcache/Python/3.11.16/x64
   Python2_ROOT_DIR: /opt/hostedtoolcache/Python/3.11.16/x64
   Python3_ROOT_DIR: /opt/hostedtoolcache/Python/3.11.16/x64
   LD_LIBRARY_PATH: /opt/hostedtoolcache/Python/3.11.16/x64/lib
 ##[endgroup]
 Requirement already satisfied: pip in /opt/hostedtoolcache/Python/3.11.16/x64/lib/python3.11/site-packages (26.2.1)
 ERROR: Could not open requirements file: [Errno 2] No such file or directory: 'requirements.txt'
 ##[error]Process completed with exit code 1.

GitHub Actions: CI/CD Pipeline / Test (3.11): ci(secret-scan): rename caller job key secret-scan -> scan (D243)

Conclusion: failure

View job details

##[group]Run python -m pip install --upgrade pip
 �[36;1mpython -m pip install --upgrade pip�[0m
 �[36;1mpip install -r requirements.txt�[0m
 �[36;1mpip install -e .�[0m
 shell: /usr/bin/bash -e {0}
 env:
   pythonLocation: /opt/hostedtoolcache/Python/3.11.16/x64
   PKG_CONFIG_PATH: /opt/hostedtoolcache/Python/3.11.16/x64/lib/pkgconfig
   Python_ROOT_DIR: /opt/hostedtoolcache/Python/3.11.16/x64
   Python2_ROOT_DIR: /opt/hostedtoolcache/Python/3.11.16/x64
   Python3_ROOT_DIR: /opt/hostedtoolcache/Python/3.11.16/x64
   LD_LIBRARY_PATH: /opt/hostedtoolcache/Python/3.11.16/x64/lib
 ##[endgroup]
 Requirement already satisfied: pip in /opt/hostedtoolcache/Python/3.11.16/x64/lib/python3.11/site-packages (26.2.1)
 ERROR: Could not open requirements file: [Errno 2] No such file or directory: 'requirements.txt'
 ##[error]Process completed with exit code 1.

GitHub Actions: CI/CD Pipeline / 3_Test (3.12).txt: ci(secret-scan): rename caller job key secret-scan -> scan (D243)

Conclusion: failure

View job details

##[group]Run python -m pip install --upgrade pip
 �[36;1mpython -m pip install --upgrade pip�[0m
 �[36;1mpip install -r requirements.txt�[0m
 �[36;1mpip install -e .�[0m
 shell: /usr/bin/bash -e {0}
 env:
   pythonLocation: /opt/hostedtoolcache/Python/3.12.14/x64
   PKG_CONFIG_PATH: /opt/hostedtoolcache/Python/3.12.14/x64/lib/pkgconfig
   Python_ROOT_DIR: /opt/hostedtoolcache/Python/3.12.14/x64
   Python2_ROOT_DIR: /opt/hostedtoolcache/Python/3.12.14/x64
   Python3_ROOT_DIR: /opt/hostedtoolcache/Python/3.12.14/x64
   LD_LIBRARY_PATH: /opt/hostedtoolcache/Python/3.12.14/x64/lib
 ##[endgroup]
 Requirement already satisfied: pip in /opt/hostedtoolcache/Python/3.12.14/x64/lib/python3.12/site-packages (26.2.1)
 ERROR: Could not open requirements file: [Errno 2] No such file or directory: 'requirements.txt'
 ##[error]Process completed with exit code 1.

GitHub Actions: CI/CD Pipeline / Test (3.12): ci(secret-scan): rename caller job key secret-scan -> scan (D243)

Conclusion: failure

View job details

##[group]Run python -m pip install --upgrade pip
 �[36;1mpython -m pip install --upgrade pip�[0m
 �[36;1mpip install -r requirements.txt�[0m
 �[36;1mpip install -e .�[0m
 shell: /usr/bin/bash -e {0}
 env:
   pythonLocation: /opt/hostedtoolcache/Python/3.12.14/x64
   PKG_CONFIG_PATH: /opt/hostedtoolcache/Python/3.12.14/x64/lib/pkgconfig
   Python_ROOT_DIR: /opt/hostedtoolcache/Python/3.12.14/x64
   Python2_ROOT_DIR: /opt/hostedtoolcache/Python/3.12.14/x64
   Python3_ROOT_DIR: /opt/hostedtoolcache/Python/3.12.14/x64
   LD_LIBRARY_PATH: /opt/hostedtoolcache/Python/3.12.14/x64/lib
 ##[endgroup]
 Requirement already satisfied: pip in /opt/hostedtoolcache/Python/3.12.14/x64/lib/python3.12/site-packages (26.2.1)
 ERROR: Could not open requirements file: [Errno 2] No such file or directory: 'requirements.txt'
 ##[error]Process completed with exit code 1.

GitHub Actions: CI/CD Pipeline / 5_Test (3.10).txt: ci(secret-scan): rename caller job key secret-scan -> scan (D243)

Conclusion: failure

View job details

##[group]Run python -m pip install --upgrade pip
 �[36;1mpython -m pip install --upgrade pip�[0m
 �[36;1mpip install -r requirements.txt�[0m
 �[36;1mpip install -e .�[0m
 shell: /usr/bin/bash -e {0}
 env:
   pythonLocation: /opt/hostedtoolcache/Python/3.10.21/x64
   PKG_CONFIG_PATH: /opt/hostedtoolcache/Python/3.10.21/x64/lib/pkgconfig
   Python_ROOT_DIR: /opt/hostedtoolcache/Python/3.10.21/x64
   Python2_ROOT_DIR: /opt/hostedtoolcache/Python/3.10.21/x64
   Python3_ROOT_DIR: /opt/hostedtoolcache/Python/3.10.21/x64
   LD_LIBRARY_PATH: /opt/hostedtoolcache/Python/3.10.21/x64/lib
 ##[endgroup]
 Requirement already satisfied: pip in /opt/hostedtoolcache/Python/3.10.21/x64/lib/python3.10/site-packages (26.2.1)
 ERROR: Could not open requirements file: [Errno 2] No such file or directory: 'requirements.txt'
 ##[error]Process completed with exit code 1.

GitHub Actions: CI/CD Pipeline / Test (3.10): ci(secret-scan): rename caller job key secret-scan -> scan (D243)

Conclusion: failure

View job details

##[group]Run python -m pip install --upgrade pip
 �[36;1mpython -m pip install --upgrade pip�[0m
 �[36;1mpip install -r requirements.txt�[0m
 �[36;1mpip install -e .�[0m
 shell: /usr/bin/bash -e {0}
 env:
   pythonLocation: /opt/hostedtoolcache/Python/3.10.21/x64
   PKG_CONFIG_PATH: /opt/hostedtoolcache/Python/3.10.21/x64/lib/pkgconfig
   Python_ROOT_DIR: /opt/hostedtoolcache/Python/3.10.21/x64
   Python2_ROOT_DIR: /opt/hostedtoolcache/Python/3.10.21/x64
   Python3_ROOT_DIR: /opt/hostedtoolcache/Python/3.10.21/x64
   LD_LIBRARY_PATH: /opt/hostedtoolcache/Python/3.10.21/x64/lib
 ##[endgroup]
 Requirement already satisfied: pip in /opt/hostedtoolcache/Python/3.10.21/x64/lib/python3.10/site-packages (26.2.1)
 ERROR: Could not open requirements file: [Errno 2] No such file or directory: 'requirements.txt'
 ##[error]Process completed with exit code 1.

GitHub Actions: CI/CD Pipeline / 6_Build Documentation.txt: ci(secret-scan): rename caller job key secret-scan -> scan (D243)

Conclusion: failure

View job details

##[group]Run python -m pip install --upgrade pip
 �[36;1mpython -m pip install --upgrade pip�[0m
 �[36;1mpip install -r requirements.txt�[0m
 shell: /usr/bin/bash -e {0}
 env:
   pythonLocation: /opt/hostedtoolcache/Python/3.11.16/x64
   PKG_CONFIG_PATH: /opt/hostedtoolcache/Python/3.11.16/x64/lib/pkgconfig
   Python_ROOT_DIR: /opt/hostedtoolcache/Python/3.11.16/x64
   Python2_ROOT_DIR: /opt/hostedtoolcache/Python/3.11.16/x64
   Python3_ROOT_DIR: /opt/hostedtoolcache/Python/3.11.16/x64
   LD_LIBRARY_PATH: /opt/hostedtoolcache/Python/3.11.16/x64/lib
 ##[endgroup]
 Requirement already satisfied: pip in /opt/hostedtoolcache/Python/3.11.16/x64/lib/python3.11/site-packages (26.2.1)
 ERROR: Could not open requirements file: [Errno 2] No such file or directory: 'requirements.txt'
 ##[error]Process completed with exit code 1.

GitHub Actions: CI/CD Pipeline / Build Documentation: ci(secret-scan): rename caller job key secret-scan -> scan (D243)

Conclusion: failure

View job details

##[group]Run python -m pip install --upgrade pip
 �[36;1mpython -m pip install --upgrade pip�[0m
 �[36;1mpip install -r requirements.txt�[0m
 shell: /usr/bin/bash -e {0}
 env:
   pythonLocation: /opt/hostedtoolcache/Python/3.11.16/x64
   PKG_CONFIG_PATH: /opt/hostedtoolcache/Python/3.11.16/x64/lib/pkgconfig
   Python_ROOT_DIR: /opt/hostedtoolcache/Python/3.11.16/x64
   Python2_ROOT_DIR: /opt/hostedtoolcache/Python/3.11.16/x64
   Python3_ROOT_DIR: /opt/hostedtoolcache/Python/3.11.16/x64
   LD_LIBRARY_PATH: /opt/hostedtoolcache/Python/3.11.16/x64/lib
 ##[endgroup]
 Requirement already satisfied: pip in /opt/hostedtoolcache/Python/3.11.16/x64/lib/python3.11/site-packages (26.2.1)
 ERROR: Could not open requirements file: [Errno 2] No such file or directory: 'requirements.txt'
 ##[error]Process completed with exit code 1.

GitHub Actions: Governance / 7_governance _ Security policy checks.txt: ci(secret-scan): rename caller job key secret-scan -> scan (D243)

Conclusion: failure

View job details

##[group]Run FAILED=false
 �[36;1mFAILED=false�[0m
 �[36;1mWEAK_CRYPTO=$(grep -rE 'md5\(|sha1\(' --include="*.py" --include="*.rb" --include="*.js" --include="*.ts" --include="*.go" --include="*.rs" . 2>/dev/null | grep -v 'checksum\|cache\|test\|spec' | head -5 || true)�[0m
 �[36;1mif [ -n "$WEAK_CRYPTO" ]; then�[0m
 �[36;1m  echo "::warning::Weak crypto (MD5/SHA1) detected — ADVISORY, does not fail this job. Use SHA256+:"�[0m
 �[36;1m  echo "$WEAK_CRYPTO"�[0m
 �[36;1mfi�[0m
 �[36;1mHTTP_URLS=$(grep -rE 'http://[^l][^o][^c]' --include="*.py" --include="*.js" --include="*.ts" --include="*.go" --include="*.rs" --include="*.yaml" --include="*.yml" . 2>/dev/null | grep -v 'localhost\|127.0.0.1\|example\|test\|spec' | head -5 || true)�[0m
 �[36;1mif [ -n "$HTTP_URLS" ]; then�[0m
 �[36;1m  echo "::warning::HTTP URLs found — ADVISORY, does not fail this job. Use HTTPS:"�[0m
 �[36;1m  echo "$HTTP_URLS"�[0m
 �[36;1mfi�[0m
 �[36;1mSECRETS=$(grep -rEi '(api_key|apikey|secret_key|password)\s*[=:]\s*["\x27][A-Za-z0-9+/=]{20,}' --include="*.py" --include="*.js" --include="*.ts" --include="*.go" --include="*.rs" --include="*.env" . 2>/dev/null | grep -v 'example\|sample\|test\|mock\|placeholder' | head -3 || true)�[0m
 �[36;1mif [ -n "$SECRETS" ]; then�[0m
 �[36;1m  echo "::error::Potential hardcoded secrets detected — this FAILS the job:"�[0m

GitHub Actions: Governance / governance _ Security policy checks: ci(secret-scan): rename caller job key secret-scan -> scan (D243)

Conclusion: failure

View job details

##[group]Run FAILED=false
 �[36;1mFAILED=false�[0m
 �[36;1mWEAK_CRYPTO=$(grep -rE 'md5\(|sha1\(' --include="*.py" --include="*.rb" --include="*.js" --include="*.ts" --include="*.go" --include="*.rs" . 2>/dev/null | grep -v 'checksum\|cache\|test\|spec' | head -5 || true)�[0m
 �[36;1mif [ -n "$WEAK_CRYPTO" ]; then�[0m
 �[36;1m  echo "::warning::Weak crypto (MD5/SHA1) detected — ADVISORY, does not fail this job. Use SHA256+:"�[0m
 �[36;1m  echo "$WEAK_CRYPTO"�[0m
 �[36;1mfi�[0m
 �[36;1mHTTP_URLS=$(grep -rE 'http://[^l][^o][^c]' --include="*.py" --include="*.js" --include="*.ts" --include="*.go" --include="*.rs" --include="*.yaml" --include="*.yml" . 2>/dev/null | grep -v 'localhost\|127.0.0.1\|example\|test\|spec' | head -5 || true)�[0m
 �[36;1mif [ -n "$HTTP_URLS" ]; then�[0m
 �[36;1m  echo "::warning::HTTP URLs found — ADVISORY, does not fail this job. Use HTTPS:"�[0m
 �[36;1m  echo "$HTTP_URLS"�[0m
 �[36;1mfi�[0m
 �[36;1mSECRETS=$(grep -rEi '(api_key|apikey|secret_key|password)\s*[=:]\s*["\x27][A-Za-z0-9+/=]{20,}' --include="*.py" --include="*.js" --include="*.ts" --include="*.go" --include="*.rs" --include="*.env" . 2>/dev/null | grep -v 'example\|sample\|test\|mock\|placeholder' | head -3 || true)�[0m
 �[36;1mif [ -n "$SECRETS" ]; then�[0m
 �[36;1m  echo "::error::Potential hardcoded secrets detected — this FAILS the job:"�[0m

GitHub Actions: Governance / governance _ Security policy checks: ci(secret-scan): rename caller job key secret-scan -> scan (D243)

Conclusion: failure

View job details

##[group]Run set -uo pipefail
 �[36;1mset -uo pipefail�[0m
 �[36;1mDIR=.github/canonical-references�[0m
 �[36;1mif [ ! -d "$DIR" ]; then�[0m
 �[36;1m  echo "ℹ️  [R5] no $DIR/ — skipped (repo has not opted in)"�[0m
 �[36;1m  exit 0�[0m
 �[36;1mfi�[0m
 �[36;1mif ! command -v python3 >/dev/null 2>&1; then�[0m
 �[36;1m  echo "❌ [R5] python3 missing on runner — required for YAML rule parsing"�[0m
 �[36;1m  exit 2�[0m
 �[36;1mfi�[0m
 �[36;1mpython3 - <<'PY'�[0m
 �[36;1mimport os, sys, glob, subprocess�[0m
 �[36;1mtry:�[0m
 �[36;1m    import yaml�[0m
 �[36;1mexcept ImportError:�[0m
 �[36;1m    sys.exit("❌ [R5] PyYAML not installed on runner; install python3-yaml")�[0m
 �[36;1m�[0m
 �[36;1mdir_ = ".github/canonical-references"�[0m
 �[36;1mfiles = sorted(glob.glob(f"{dir_}/*.yml") + glob.glob(f"{dir_}/*.yaml"))�[0m
 �[36;1mif not files:�[0m
 �[36;1m    print(f"ℹ️  [R5] {dir_}/ has no .yml/.yaml rules — skipped")�[0m
 �[36;1m    sys.exit(0)�[0m
 �[36;1m�[0m
 �[36;1mtotal = 0�[0m
 �[36;1mfor rf in files:�[0m
 �[36;1m    with open(rf, encoding="utf-8") as fh:�[0m
 �[36;1m        cfg = yaml.safe_load(fh)�[0m
 �[36;1m    if not isinstance(cfg, dict):�[0m
 �[36;1m        print(f"❌ [R5] {rf}: top-level must be a mapping"); total += 1; continue�[0m
 �[36;1m    rid  = cfg.get("id", os.path.basename(rf))�[0m
 �[36;1m    desc = cfg.get("description", "")�[0m
 �[36;1m    pats = cfg.get("patterns") or []�[0m
 �[36;1m    canon = cfg.get("canonical_pointer", "")�[0m
 �[36;1m    scope = (cfg.get("scope") or {})�[0m
 �[36;1m    includes = scope.get("include") or []�[0m
 �[36;1m    if not pats or not includes:�[0m
 �[36;1m        print(f"❌ [R5:{rid}] missing patterns or scope.include in {rf}")�[0m
 �[36;1m        total += 1; continue�[0m
 �[36;1m    # exclude self-references�[0m
 �[36;1m    skip = set(["CHANGELOG.md", "CHANGELOG.adoc", rf])�[0m
 �[36;1m    if canon: skip.add(canon)�[0m
 �[36;1m    rule_hits = 0�[0m
 �[36;1m    for f_ in includes:�[0m
 �[36;1m        if f_ in skip or not os...

GitHub Actions: Governance / 8_governance _ Code quality + docs.txt: ci(secret-scan): rename caller job key secret-scan -> scan (D243)

Conclusion: failure

View job details

##[group]Run editorconfig-checker/action-editorconfig-checker@840e866d93b8e032123c23bac69dece044d4d84c
 with:
   github-***REDACTED_SECRET_ASSIGNMENT***
   version: latest
 ##[endgroup]
 Find 'latest' release
 ##[error]Error: The binary 'ec-linux-amd64*' not found

GitHub Actions: Governance / governance _ Code quality + docs: ci(secret-scan): rename caller job key secret-scan -> scan (D243)

Conclusion: failure

View job details

##[group]Run editorconfig-checker/action-editorconfig-checker@840e866d93b8e032123c23bac69dece044d4d84c
 with:
   github-***REDACTED_SECRET_ASSIGNMENT***
   version: latest
 ##[endgroup]
 Find 'latest' release
 ##[error]Error: The binary 'ec-linux-amd64*' not found

GitHub Actions: Governance / 9_governance _ Workflow security linter.txt: ci(secret-scan): rename caller job key secret-scan -> scan (D243)

Conclusion: failure

View job details

##[group]Run if [ "$GITHUB_REPOSITORY" = hyperpolymath/standards ]; then
 �[36;1mif [ "$GITHUB_REPOSITORY" = hyperpolymath/standards ]; then�[0m
 �[36;1m  SCRIPT="tools/policy/check-workflows-parse.sh"�[0m
 �[36;1m  echo "Using this repository's own copy (standards self-lint)."�[0m
 �[36;1melse�[0m
 �[36;1m  SCRIPT=".standards-dupkey/tools/policy/check-workflows-parse.sh"�[0m
 �[36;1mfi�[0m
 �[36;1mif [ ! -f "$SCRIPT" ]; then�[0m
 �[36;1m  echo "::error::workflow parser gate not found in the pinned Standards revision or locally"�[0m

GitHub Actions: Governance / governance _ Workflow security linter: ci(secret-scan): rename caller job key secret-scan -> scan (D243)

Conclusion: failure

View job details

##[group]Run if [ "$GITHUB_REPOSITORY" = hyperpolymath/standards ]; then
 �[36;1mif [ "$GITHUB_REPOSITORY" = hyperpolymath/standards ]; then�[0m
 �[36;1m  SCRIPT="tools/policy/check-workflows-parse.sh"�[0m
 �[36;1m  echo "Using this repository's own copy (standards self-lint)."�[0m
 �[36;1melse�[0m
 �[36;1m  SCRIPT=".standards-dupkey/tools/policy/check-workflows-parse.sh"�[0m
 �[36;1mfi�[0m
 �[36;1mif [ ! -f "$SCRIPT" ]; then�[0m
 �[36;1m  echo "::error::workflow parser gate not found in the pinned Standards revision or locally"�[0m

GitHub Actions: Governance / governance _ Workflow security linter: ci(secret-scan): rename caller job key secret-scan -> scan (D243)

Conclusion: failure

View job details

##[group]Run # GitHub Actions REJECTS a workflow with duplicate keys: the run is
 �[36;1m# GitHub Actions REJECTS a workflow with duplicate keys: the run is�[0m
 �[36;1m# `failure` with no jobs, no log and no check run. Nothing else here�[0m
 �[36;1m# can see it, because yaml.safe_load silently keeps the LAST�[0m
 �[36;1m# duplicate and reports success — so the file "parses" and every�[0m
 �[36;1m# other lint passes. Measured 2026-08-05: nine workflows in hypatia�[0m
 �[36;1m# were dead this way, including a CodeQL workflow with zero�[0m
 �[36;1m# successful runs in its entire lifetime.�[0m
 �[36;1mset -euo pipefail�[0m
 �[36;1m# Standards exercises its pull-request scripts; every consumer uses�[0m
 �[36;1m# the canonical scripts fetched from this workflow's immutable�[0m
 �[36;1m# Standards revision.�[0m
 �[36;1mif [ "$GITHUB_REPOSITORY" = hyperpolymath/standards ]; then�[0m
 �[36;1m  SCRIPT="scripts/check-workflow-duplicate-keys.sh"�[0m
 �[36;1m  echo "Using this repository's own copy (standards self-lint)."�[0m
 �[36;1melse�[0m
 �[36;1m  SCRIPT=".standards-dupkey/scripts/check-workflow-duplicate-keys.sh"�[0m
 �[36;1mfi�[0m
 �[36;1mif [ ! -f "$SCRIPT" ]; then�[0m
 �[36;1m  echo "::error::duplicate-key checker not found — neither fetched from" \�[0m

GitHub Actions: Governance / 10_governance _ Actions lockfile verify.txt: ci(secret-scan): rename caller job key secret-scan -> scan (D243)

Conclusion: failure

View job details

##[group]Run set -uo pipefail
 �[36;1mset -uo pipefail�[0m
 �[36;1mif [ "$GITHUB_REPOSITORY" = hyperpolymath/standards ]; then�[0m
 �[36;1m  SRC=scripts�[0m
 �[36;1m  echo "Using this repository's own gate + verifier (standards self-lint)."�[0m
 �[36;1melse�[0m
 �[36;1m  SRC=.standards-lock/scripts�[0m
 �[36;1mfi�[0m
 �[36;1mfor f in check-actions-lock-gate.sh update-actions-lock.sh; do�[0m
 �[36;1m  if [ ! -f "$SRC/$f" ]; then�[0m
 �[36;1m    echo "::error::actions-lock gate: $f not found in $SRC (standards checkout at job.workflow_sha failed?)"�[0m

GitHub Actions: Governance / governance _ Actions lockfile verify: ci(secret-scan): rename caller job key secret-scan -> scan (D243)

Conclusion: failure

View job details

##[group]Run set -uo pipefail
 �[36;1mset -uo pipefail�[0m
 �[36;1mif [ "$GITHUB_REPOSITORY" = hyperpolymath/standards ]; then�[0m
 �[36;1m  SRC=scripts�[0m
 �[36;1m  echo "Using this repository's own gate + verifier (standards self-lint)."�[0m
 �[36;1melse�[0m
 �[36;1m  SRC=.standards-lock/scripts�[0m
 �[36;1mfi�[0m
 �[36;1mfor f in check-actions-lock-gate.sh update-actions-lock.sh; do�[0m
 �[36;1m  if [ ! -f "$SRC/$f" ]; then�[0m
 �[36;1m    echo "::error::actions-lock gate: $f not found in $SRC (standards checkout at job.workflow_sha failed?)"�[0m

GitHub Actions: Governance / 12_governance _ Language _ package anti-pattern policy.txt: ci(secret-scan): rename caller job key secret-scan -> scan (D243)

Conclusion: failure

View job details

##[group]Run SCRIPT=".standards-checkout/scripts/check-ts-allowlist.sh"
 �[36;1mSCRIPT=".standards-checkout/scripts/check-ts-allowlist.sh"�[0m
 �[36;1mif [ ! -f "$SCRIPT" ] && [ "$GITHUB_REPOSITORY" = "hyperpolymath/standards" ] \�[0m
 �[36;1m   && [ -f scripts/check-ts-allowlist.sh ]; then�[0m
 �[36;1m  SCRIPT="scripts/check-ts-allowlist.sh"�[0m
 �[36;1m  echo "Using this repository's own copy (standards self-check)."�[0m
 �[36;1mfi�[0m
 �[36;1mif [ ! -f "$SCRIPT" ]; then�[0m
 �[36;1m  echo "::error::check-ts-allowlist gate not found in standards@main or locally"�[0m

GitHub Actions: Governance / governance _ Language _ package anti-pattern policy: ci(secret-scan): rename caller job key secret-scan -> scan (D243)

Conclusion: failure

View job details

##[group]Run SCRIPT=".standards-checkout/scripts/check-ts-allowlist.sh"
 �[36;1mSCRIPT=".standards-checkout/scripts/check-ts-allowlist.sh"�[0m
 �[36;1mif [ ! -f "$SCRIPT" ] && [ "$GITHUB_REPOSITORY" = "hyperpolymath/standards" ] \�[0m
 �[36;1m   && [ -f scripts/check-ts-allowlist.sh ]; then�[0m
 �[36;1m  SCRIPT="scripts/check-ts-allowlist.sh"�[0m
 �[36;1m  echo "Using this repository's own copy (standards self-check)."�[0m
 �[36;1mfi�[0m
 �[36;1mif [ ! -f "$SCRIPT" ]; then�[0m
 �[36;1m  echo "::error::check-ts-allowlist gate not found in standards@main or locally"�[0m

GitHub Actions: Governance / governance _ Language _ package anti-pattern policy: ci(secret-scan): rename caller job key secret-scan -> scan (D243)

Conclusion: failure

View job details

##[group]Run SCRIPT=".standards-checkout/tools/policy/check-language-policy.sh"
 �[36;1mSCRIPT=".standards-checkout/tools/policy/check-language-policy.sh"�[0m
 �[36;1mif [ ! -f "$SCRIPT" ] && [ -f tools/policy/check-language-policy.sh ]; then�[0m
 �[36;1m  SCRIPT="tools/policy/check-language-policy.sh"�[0m
 �[36;1m  echo "Using this repository's own copy (standards self-check)."�[0m
 �[36;1mfi�[0m
 �[36;1mif [ ! -f "$SCRIPT" ]; then�[0m
 �[36;1m  echo "::error::language-policy gate not found in standards@main or locally"�[0m

GitHub Actions: Governance / 13_governance _ Well-Known (RFC 9116 + RSR).txt: ci(secret-scan): rename caller job key secret-scan -> scan (D243)

Conclusion: failure

View job details

##[group]Run SECTXT=""
 �[36;1mSECTXT=""�[0m
 �[36;1m[ -f ".well-known/security.txt" ] && SECTXT=".well-known/security.txt"�[0m
 �[36;1m[ -f "security.txt" ] && SECTXT="security.txt"�[0m
 �[36;1mif [ -z "$SECTXT" ]; then�[0m
 �[36;1m  echo "::warning::No security.txt found."�[0m
 �[36;1m  exit 0�[0m
 �[36;1mfi�[0m
 �[36;1mgrep -q "^Contact:" "$SECTXT" || { echo "::error::Missing Contact field"; exit 1; }�[0m

GitHub Actions: Governance / governance _ Well-Known (RFC 9116 + RSR): ci(secret-scan): rename caller job key secret-scan -> scan (D243)

Conclusion: failure

View job details

##[group]Run SECTXT=""
 �[36;1mSECTXT=""�[0m
 �[36;1m[ -f ".well-known/security.txt" ] && SECTXT=".well-known/security.txt"�[0m
 �[36;1m[ -f "security.txt" ] && SECTXT="security.txt"�[0m
 �[36;1mif [ -z "$SECTXT" ]; then�[0m
 �[36;1m  echo "::warning::No security.txt found."�[0m
 �[36;1m  exit 0�[0m
 �[36;1mfi�[0m
 �[36;1mgrep -q "^Contact:" "$SECTXT" || { echo "::error::Missing Contact field"; exit 1; }�[0m

GitHub Actions: Governance / governance _ Well-Known (RFC 9116 + RSR): ci(secret-scan): rename caller job key secret-scan -> scan (D243)

Conclusion: failure

View job details

##[group]Run MIXED=$(grep -rE 'src="http://|href="http://' --include="*.html" --include="*.htm" . 2>/dev/null | grep -vE 'localhost|127\.0\.0\.1|example\.com|lol/|node_modules/|third-party/|vendor/' | head -5 || true)
 �[36;1mMIXED=$(grep -rE 'src="http://|href="http://' --include="*.html" --include="*.htm" . 2>/dev/null | grep -vE 'localhost|127\.0\.0\.1|example\.com|lol/|node_modules/|third-party/|vendor/' | head -5 || true)�[0m
 �[36;1mif [ -n "$MIXED" ]; then�[0m
 �[36;1m  echo "::error::Mixed content (HTTP in HTML)"�[0m

🔇 Additional comments (1)

.github/workflows/secret-scanner.yml (1)

18-18: LGTM!

📝 Summary

Summary by CodeRabbit

Chores
- Updated the automated security scanning workflow. It continues to use the same scanning process and secret access, so there is no change to application behavior.

Walkthrough

The secret scanner workflow job is renamed from secret-scan to scan. Its reusable workflow and secret inheritance remain unchanged.

Changes

Secret scanner workflow

Layer / File(s)	Summary
Rename the workflow job `.github/workflows/secret-scanner.yml`	The job identifier changes from `secret-scan` to `scan`. The reusable workflow and secret inheritance remain unchanged.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~2 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to d6b9b

The scanner workflow behavior is preserved while its job name changes as intended. No actionable merge-blocking risk is established; proceed with normal checks.

Architecture Summary

Architecture risk: 🔵 Low · up to d6b9b

The changed surface does not map to a changed system, dependency edge, entrypoint, or external dependency.

Changed systems: None identified.

Architecture concerns
No architecture-level concerns identified.

Review details

Before / after behavior

observed — Modified behavior in .github/workflows/secret-scanner.yml: The job identifier changes from secret-scan to scan; its reusable workflow and secret inheritance remain unchanged.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description accurately explains the one-line workflow change and its purpose. However, it does not follow the repository template and omits required sections such as Type of Change, Related Issues…	Update the description to use the repository template. Mark the applicable change type, provide the related issue or state that none applies, list the change, document `actionlint` testing and results, complete relevant checklist items, and…

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the CI change: renaming the `secret-scan` caller job key to `scan`.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Description check

Explanation

The description accurately explains the one-line workflow change and its purpose. However, it does not follow the repository template and omits required sections such as Type of Change, Related Issues, Changes Made, Testing details, Checklist items, and Breaking Changes.

Resolution

Update the description to use the repository template. Mark the applicable change type, provide the related issue or state that none applies, list the change, document actionlint testing and results, complete relevant checklist items, and state the breaking-change status.

Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

Commit to this branch
Create a new PR

Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{A rabbit checks the scanner’s name,
The workflow call stays just the same.
Secrets still pass as they did before,
scan takes the name secret-scan wore.
Then hops away across the floor.}

_{Comment @coderabbitai help to get the list of available commands.}

coderabbitai Bot approved these changes Oct 1, 2026

View reviewed changes

hyperpolymath merged commit 701dc5e into main Oct 1, 2026
32 of 41 checks passed

hyperpolymath deleted the ci/secret-scan-floor-key branch October 1, 2026 12:37

hyperpolymath mentioned this pull request Oct 1, 2026

Secret-Scan-Floor (D243/D244): sweep results and open items with acceptance criteria hyperpolymath/standards#1108

Open

20 tasks

Navigation Menu

Uh oh!

ci(secret-scan): rename caller job key secret-scan -> scan (D243) - #91

ci(secret-scan): rename caller job key secret-scan -> scan (D243)#91
hyperpolymath merged 1 commit into
mainfrom
ci/secret-scan-floor-key

hyperpolymath commented Oct 1, 2026

Uh oh!

coderabbitai Bot commented Oct 1, 2026 •

edited

Loading

Summary by CodeRabbit

Walkthrough

Changes

❌ Failed checks (1 warning)

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

hyperpolymath commented Oct 1, 2026

What

Uh oh!

coderabbitai Bot commented Oct 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Walkthrough

Changes

Architecture Summary

❌ Failed checks (1 warning)

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

coderabbitai Bot commented Oct 1, 2026 •

edited

Loading