ci(secret-scanner): call estate reusable as job scan (D243 floor)

[hyperpolymath]

Why

The estate-wide Secret-Scan-Floor ruleset (owner ruling D243, ruleset 24276941 on this repo) requires the status-check context scan / gitleaks on the default branch. This caller ran inline jobs and emitted a bare gitleaks context, so no PR here could satisfy the floor.

Change

• The inline trufflehog, gitleaks and rust-secrets jobs are replaced by one call to hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@74d2f66 (the latest on standards main), under job key scan, with secrets: inherit.
• TruffleHog is retired: the reusable deliberately dropped it as redundant with gitleaks (see the reusable's header).
• actionlint is clean. This repo has no actions.lock, so there is no transitive-closure risk.

Note for open PRs

#61 (another session's) cannot satisfy the floor until this lands. After merge it needs its checks re-run (or a rebase) so that it emits scan / gitleaks.

Role in the rollout

Positive-control pilot for D243. Measured: while only scan / gitleaks was pending, mergeStateStatus read BLOCKED; once it went green, UNSTABLE. So the floor gates mergeability. This PR was not armed for auto-merge: scan / gitleaks completed (~20–60 s) before arming could be issued, and arming an UNSTABLE PR merges it instantly. The landing form is pending an owner decision.

Deferred checks

• Hypatia (non-required) — WH008 note on secrets: inherit: deferred to Hypatia workflow_hardening triage: secrets-inherit convention + WH013/WH006 false positives (7 instances) standards#943. The reusable secret-scanner-reusable.yml header mandates secrets: inherit for callers; the convention is triaged there, not per-repo.

🤖 Generated with Claude Code

https://claude.ai/code/session_0136eszqrQ53Kj7aBH1D4rXK

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: dac3e98b-5ffb-441e-a97c-b2d8e9d385fa

📥 Commits

Reviewing files that changed from the base of the PR and between f97ff35 and 640f168.

📒 Files selected for processing (1)

• .github/workflows/secret-scanner.yml

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

⏰ Context from checks skipped due to timeout. (11)

• GitHub Check: governance / Trusted-base reduction policy
• GitHub Check: governance / Security policy checks
• GitHub Check: governance / Code quality + docs
• GitHub Check: governance / Licence consistency
• GitHub Check: governance / Check Workflow Staleness
• GitHub Check: governance / Language / package anti-pattern policy
• GitHub Check: scan / gitleaks
• GitHub Check: scan / shell-secrets
• GitHub Check: Hypatia Neurosymbolic Analysis
• GitHub Check: analyze (actions, none)
• GitHub Check: semgrep-cloud-platform/scan

🔇 Additional comments (1)

.github/workflows/secret-scanner.yml (1)

27-29: LGTM!

---

📝 Summary

Summary by CodeRabbit

• Chores
  • Secret scanning now runs through a shared scanning workflow instead of the previous set of scanning jobs. The workflow keeps its existing triggers, cancellation behaviour and read-only permissions. This changes how repository scans are run without changing when the workflow is triggered.

Walkthrough

The secret-scanner workflow replaces its inline TruffleHog, Gitleaks and Rust-specific jobs with a pinned reusable scanner workflow. The workflow name, triggers, concurrency cancellation and read-only contents permissions remain unchanged.

Changes

Secret scanning

Layer / File(s)	Summary
Reusable scanner workflow .github/workflows/secret-scanner.yml	The workflow calls the shared scanner at a pinned commit and inherits repository secrets. The workflow name and triggers remain unchanged. Comments describe the reusable workflow requirements.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to 640f1

The workflow delegates secret scanning to the pinned shared implementation while preserving its triggers and read-only permissions. It is ready to merge subject to normal CI checks.

Architecture Summary

Architecture risk: 🔵 Low · up to 640f1

The changed surface does not map to a changed system, dependency edge, entrypoint, or external dependency.

Changed systems: None identified.

Architecture concerns
No architecture-level concerns identified.

Review details

Before / after behavior

• observed — Modified behavior in .github/workflows/secret-scanner.yml: Comments now document the reusable scanner, the required scan job key and secrets: inherit; the former inline-implementation and concurrency comments were removed.
• observed — Modified behavior in .github/workflows/secret-scanner.yml: The workflow name and pull-request and main push triggers are unchanged; the old inline TruffleHog, Gitleaks and Rust scanning jobs are replaced by the reusable scanner job.
• observed — Modified behavior in .github/workflows/secret-scanner.yml: Replaces the three inline scanning jobs with a scan job that calls the shared reusable workflow at a pinned commit and inherits secrets.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description explains the purpose and implementation, but it does not follow the repository template. It omits the required Summary, Changes, RSR Quality Checklist, Testing, and Screenshots section…	Reformat the description to use the repository template. Add Summary, Changes, RSR Quality Checklist, Testing, and Screenshots sections. Mark each applicable checklist item and describe the test commands and results.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly identifies the main change: the secret-scanner CI job now calls the estate reusable workflow.

Full details: Description check

Explanation

The description explains the purpose and implementation, but it does not follow the repository template. It omits the required Summary, Changes, RSR Quality Checklist, Testing, and Screenshots sections, and it does not record the required checklist results.

• Fix all pre-merge checks with AI

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit checks the scanner’s call,
Then watches secrets, one and all.
The old inline jobs depart,
A pinned workflow takes their part.
The triggers stay; the checks begin,
The rabbit hops with ears held in.}

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

🔍 Hypatia Security Scan

Findings: 80 issues detected

Severity	Count
🔴 Critical	6
🟠 High	42
🟡 Medium	32

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Job `triage` in label-triage.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).",
    "type": "missing_timeout_minutes",
    "file": "label-triage.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium",
    "recipe_id": "recipe-add-workflow-timeout-minutes",
    "job": "triage"
  },
  {
    "reason": "Job `sync` in labels.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).",
    "type": "missing_timeout_minutes",
    "file": "labels.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium",
    "recipe_id": "recipe-add-workflow-timeout-minutes",
    "job": "sync"
  },
  {
    "line": 38,
    "reason": "job in .github/workflows/labels.yml references `secrets.*` but does not install `step-security/harden-runner` — review outbound-egress monitoring",
    "type": "RE001",
    "file": ".github/workflows/labels.yml",
    "action": "report",
    "rule_module": "research_extensions",
    "severity": "warn"
  },
  {
    "line": 44,
    "reason": "job in .github/workflows/push-email-notify.yml references `secrets.*` but does not install `step-security/harden-runner` — review outbound-egress monitoring",
    "type": "RE001",
    "file": ".github/workflows/push-email-notify.yml",
    "action": "report",
    "rule_module": "research_extensions",
    "severity": "warn"
  },
  {
    "line": 82,
    "reason": "job in .github/workflows/hypatia-scan.yml references `secrets.*` but does not install `step-security/harden-runner` — review outbound-egress monitoring",
    "type": "RE001",
    "file": ".github/workflows/hypatia-scan.yml",
    "action": "report",
    "rule_module": "research_extensions",
    "severity": "warn"
  },
  {
    "line": 52,
    "reason": "job in .github/workflows/label-triage.yml references `secrets.*` but does not install `step-security/harden-runner` — review outbound-egress monitoring",
    "type": "RE001",
    "file": ".github/workflows/label-triage.yml",
    "action": "report",
    "rule_module": "research_extensions",
    "severity": "warn"
  },
  {
    "line": 24,
    "reason": "job in .github/workflows/mirror.yml references `secrets.*` but does not install `step-security/harden-runner` — review outbound-egress monitoring",
    "type": "RE001",
    "file": ".github/workflows/mirror.yml",
    "action": "report",
    "rule_module": "research_extensions",
    "severity": "warn"
  },
  {
    "line": 44,
    "reason": "job in .github/workflows/mirror.yml references `secrets.*` but does not install `step-security/harden-runner` — review outbound-egress monitoring",
    "type": "RE001",
    "file": ".github/workflows/mirror.yml",
    "action": "report",
    "rule_module": "research_extensions",
    "severity": "warn"
  },
  {
    "line": 64,
    "reason": "job in .github/workflows/mirror.yml references `secrets.*` but does not install `step-security/harden-runner` — review outbound-egress monitoring",
    "type": "RE001",
    "file": ".github/workflows/mirror.yml",
    "action": "report",
    "rule_module": "research_extensions",
    "severity": "warn"
  },
  {
    "line": 84,
    "reason": "job in .github/workflows/mirror.yml references `secrets.*` but does not install `step-security/harden-runner` — review outbound-egress monitoring",
    "type": "RE001",
    "file": ".github/workflows/mirror.yml",
    "action": "report",
    "rule_module": "research_extensions",
    "severity": "warn"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence