fix(ci): gitleaks-action → pinned gitleaks CLI (org license gate) - #62
Merged
Conversation
gitleaks-action v2 requires a paid license under GitHub Organizations; the M0.2 transfer to pixeloven tripped it — the workflow's own comment predicted this. The CLI is license-free and is the same engine harmony-ci's gate library uses. Job and check names unchanged so the required-check contract holds. Full-history scan behavior preserved (fetch-depth: 0 + git-aware detect); --redact keeps any hit out of logs. Applies the pattern all Phase 0.5 moved repos need (M0.6). Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AWb1wJP3sD5oUbBrvSQ2UC
ductiletoaster
added a commit
that referenced
this pull request
Aug 17, 2026
This repo moved: ductiletoaster/harmony-crew -> pixeloven/crew (transfer + rename in one move, Phase 0.5 M0.2 of the PixelOven Agent Stack program). GitHub redirects cover the old path, but explicit pins are the standard. * plugin.json / marketplace.json / package.json — repository URL + owner. * README + all three quickstarts — the marketplace `repo`, the pi git-package URL, and the Codex clone URL. The gitleaks-action -> CLI swap that the org move also forced landed separately in #62; this branch is rebased on it. Plugin IDENTITY is deliberately unchanged — `name: harmony-crew` in both manifests, the `harmony-crew@harmony-crew` enabledPlugins key, and the npm name. Renaming those is the outward refactor (D-03), and changing them here would break every consumer's plugin key for no migration benefit. The quickstart example tags (v0.13.0) are left as-is: this is a URL move, not a version-currency pass. Refs ductiletoaster/harmony#1115
ductiletoaster
added a commit
that referenced
this pull request
Aug 18, 2026
This repo moved: ductiletoaster/harmony-crew -> pixeloven/crew (transfer + rename in one move, Phase 0.5 M0.2 of the PixelOven Agent Stack program). GitHub redirects cover the old path, but explicit pins are the standard. * plugin.json / marketplace.json / package.json — repository URL + owner. * README + all three quickstarts — the marketplace `repo`, the pi git-package URL, and the Codex clone URL. The gitleaks-action -> CLI swap that the org move also forced landed separately in #62; this branch is rebased past it. Plugin IDENTITY is deliberately unchanged — `name: harmony-crew` in both manifests, the `harmony-crew@harmony-crew` enabledPlugins key, and the npm name. Renaming those is the outward refactor (D-03), and changing them here would break every consumer's plugin key for no migration benefit. The quickstart example tags (v0.13.0) are left as-is: this is a URL move, not a version-currency pass. Refs ductiletoaster/harmony#1115
ductiletoaster
added a commit
that referenced
this pull request
Aug 18, 2026
…60) This repo moved: ductiletoaster/harmony-crew -> pixeloven/crew (transfer + rename in one move, Phase 0.5 M0.2 of the PixelOven Agent Stack program). GitHub redirects cover the old path, but explicit pins are the standard. * plugin.json / marketplace.json / package.json — repository URL + owner. * README + all three quickstarts — the marketplace `repo`, the pi git-package URL, and the Codex clone URL. The gitleaks-action -> CLI swap that the org move also forced landed separately in #62; this branch is rebased past it. Plugin IDENTITY is deliberately unchanged — `name: harmony-crew` in both manifests, the `harmony-crew@harmony-crew` enabledPlugins key, and the npm name. Renaming those is the outward refactor (D-03), and changing them here would break every consumer's plugin key for no migration benefit. The quickstart example tags (v0.13.0) are left as-is: this is a URL move, not a version-currency pass. Refs ductiletoaster/harmony#1115
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The M0.2 org transfer tripped gitleaks-action v2's Organization license requirement — predicted by this workflow's own comment. Swap to the pinned gitleaks CLI (license-free, same engine as harmony-ci's gate library). Job/check names unchanged. Unblocks crew#61 and every subsequent PR on this repo; same pattern propagates to all Phase 0.5 moved repos (M0.6). No skills/agents touched — no version bump required.