From 9a4ee0d9100cdbe80222dae2a603d47a82ebcbcf Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Fri, 17 Jul 2026 21:33:07 +0100 Subject: [PATCH 1/2] fix(ci): drop invalid job-level timeout-minutes from reusable-workflow calls MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit A timeout-minutes: key was set on one or more jobs that call a reusable workflow via uses:. GitHub does not permit that key on a workflow_call job, so it rejected the file at parse time — the workflow failed instantly (0s) on every push and never ran. The standards *-reusable.yml workflows already declare timeout-minutes on their internal jobs, so the caller key was redundant as well as invalid. Files: .github/workflows/mirror.yml .github/workflows/secret-scanner.yml .github/workflows/spark-theatre-gate.yml Verified with actionlint (real tool): no "timeout-minutes is not available" findings remain. Part of the estate-wide CI cleanup (84 repos; reference hyperpolymath/gitbot-fleet#374). Co-Authored-By: Claude Fable 5 --- .github/workflows/mirror.yml | 1 - .github/workflows/secret-scanner.yml | 1 - .github/workflows/spark-theatre-gate.yml | 1 - 3 files changed, 3 deletions(-) diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml index f4ddfca..6bd847d 100644 --- a/.github/workflows/mirror.yml +++ b/.github/workflows/mirror.yml @@ -9,5 +9,4 @@ permissions: jobs: mirror: uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236 - timeout-minutes: 10 secrets: inherit diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index cdc999c..577a448 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -16,7 +16,6 @@ jobs: pull-requests: write actions: read uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236 - timeout-minutes: 10 secrets: inherit trufflehog: runs-on: ubuntu-latest diff --git a/.github/workflows/spark-theatre-gate.yml b/.github/workflows/spark-theatre-gate.yml index bce3480..1c8db86 100644 --- a/.github/workflows/spark-theatre-gate.yml +++ b/.github/workflows/spark-theatre-gate.yml @@ -13,7 +13,6 @@ permissions: jobs: spark-theatre-gate: uses: hyperpolymath/standards/.github/workflows/spark-theatre-gate.yml@462003782f3ebb93ea763e81d0d199ce13ef7d73 - timeout-minutes: 10 with: paths: "." enforce_zero_contract: false From 78ad1d9c56f2ef1224892f6d11e1cb415993ca7d Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Fri, 17 Jul 2026 22:46:51 +0100 Subject: [PATCH 2/2] fix(ci): remove leftover redundant trufflehog job from secret-scanner.yml MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The inline `trufflehog:` job ran `trufflesecurity/trufflehog@main` with `extra_args: --only-verified --fail`. The @main action now injects `--fail` itself, so the job died at argument parsing ("flag \x27fail\x27 cannot be repeated") BEFORE scanning anything — the secret scanner was providing zero coverage. The canonical rsr-template-repo secret-scanner.yml deliberately retired the inline TruffleHog job as redundant: the pinned standards reusable runs gitleaks + a Rust-secrets check, sufficient coverage at lower cost. This syncs the repo to that canon; the working gitleaks `scan` job is untouched. Also clears the `governance / Workflow security linter` finding (unpinned trufflehog@main). Verified: actionlint clean; reusable call intact; no trufflehog refs remain. Proven green end-to-end on ochrance-framework#28. Co-Authored-By: Claude Fable 5 --- .github/workflows/secret-scanner.yml | 10 ---------- 1 file changed, 10 deletions(-) diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index 577a448..7bd0955 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -17,13 +17,3 @@ jobs: actions: read uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236 secrets: inherit - trufflehog: - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 - with: - fetch-depth: 0 - - name: TruffleHog Secret Scan - uses: trufflesecurity/trufflehog@ef6e76c3c4023279497fab4721ffa071a722fd05 # v3.92.4 - with: - extra_args: --only-verified --fail \ No newline at end of file