chore(ci): replace secret-scanner.yml with reusable wrapper (#110)

hyperpolymath · web-flow · commit e8f8f16a5456 · 2026-05-27T13:01:37.000+01:00
## Summary Replaces this repo's `secret-scanner.yml` (~75-116 lines) with a thin ~14-line wrapper calling `hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@3e4bd4c93911750727e2e4c66dff859e00079da0` (merged via standards#190). ## Security debt closed The `shell-secrets` job (added to the canonical 2026-05-21 in direct response to the live Cloudflare API token leak via `avow-protocol/deploy-repos.sh` — a leak both `trufflehog --only-verified` and default `gitleaks` missed) was carried by 0 of 16 sampled estate copies. This PR brings that guardrail to this repo. ## Why now Estate audit: 281 `secret-scanner.yml` deployments / 54 unique SHAs / 19% true drift. Drift is pin churn + whitespace; feature variance is near-zero. Converging behind the reusable means the next post-incident guardrail update propagates via one SHA bump. `secrets: inherit` flows `GITHUB_TOKEN` through implicitly so the `gitleaks-action` step doesn't fall back to anonymous (rate-limited) mode. Part of estate-wide convergence campaign 2026-05-26 (standards#199 / #190).
diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml
@@ -1,350 +1,19 @@
 # SPDX-License-Identifier: MPL-2.0
-# Prevention workflow - scans for hardcoded secrets before they reach main
 name: Secret Scanner
 
 on:
-  workflow_dispatch:
   pull_request:
   push:
-    branches: ['**']
+    branches: [main]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
 
 permissions:
   contents: read
 
 jobs:
-  hypatia-elixir-secrets:
-    runs-on: ubuntu-22.04
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
-        with:
-          fetch-depth: 0
-
-      - name: Setup Elixir for Hypatia ruleset
-        uses: erlef/setup-beam@fc68ffb90438ef2936bbb3251622353b3dcb2f93 # v1.18.2
-        with:
-          elixir-version: '1.19.4'
-          otp-version: '28.3'
-
-      - name: Clone Hypatia
-        run: git clone --depth 1 https://github.com/hyperpolymath/hypatia.git "$RUNNER_TEMP/hypatia"
-
-      - name: Run Hypatia Elixir secret ruleset
-        id: hypatia_ruleset
-        working-directory: ${{ runner.temp }}/hypatia
-        env:
-          SCAN_REPO: ${{ github.workspace }}
-          OUTPUT_FILE: ${{ github.workspace }}/hypatia-secret-findings.json
-        run: |
-          set -euo pipefail
-          mix deps.get --only prod
-
-          cat > "$RUNNER_TEMP/hypatia-secret-scan.exs" <<'ELIXIR'
-          repo = System.fetch_env!("SCAN_REPO")
-          output = System.fetch_env!("OUTPUT_FILE")
-
-          {stdout, status} = System.cmd("git", ["-C", repo, "ls-files"])
-          if status != 0, do: raise("git ls-files failed")
-
-          tracked_files = String.split(stdout, "\n", trim: true)
-
-          findings =
-            tracked_files
-            |> Enum.reject(fn rel_path ->
-              # Known safe test files/docs containing mock credentials
-              rel_path in [
-                "emergency-room/src/zig/capture_test.zig",
-                "czech-file-knife/docs/DISTRIBUTED_FILESYSTEMS.md",
-                "hybrid-automation-router/test/attestation/a2ml_test.exs",
-                "hybrid-automation-router/test/data_plane/transformers/kubernetes_test.exs",
-                "hybrid-automation-router/docs/HAR_SECURITY.md",
-                "cicada/scripts/verify_rsr.jl",
-                "session-sentinel/.envrc"
-              ]
-            end)
-            |> Enum.flat_map(fn rel_path ->
-              abs_path = Path.join(repo, rel_path)
-
-              case File.stat(abs_path) do
-                {:ok, %File.Stat{type: :regular, size: size}} when size <= 1_000_000 ->
-                  case File.read(abs_path) do
-                    {:ok, content} ->
-                      if String.contains?(content, <<0>>) do
-                        []
-                      else
-                        Hypatia.Rules.SecurityErrors.detect_secrets(content)
-                        |> Enum.map(fn label ->
-                          %{
-                            rule_module: "security_errors",
-                            severity: "critical",
-                            type: "secret_detected",
-                            file: rel_path,
-                            reason: "Secret found: #{label}",
-                            action: "revoke_rotate_and_purge",
-                            detected_at: DateTime.utc_now() |> DateTime.to_iso8601()
-                          }
-                        end)
-                      end
-
-                    _ ->
-                      []
-                  end
-
-                _ ->
-                  []
-              end
-            end)
-
-          File.write!(output, Jason.encode!(findings, pretty: true))
-          IO.puts("secret_findings=#{length(findings)}")
-          ELIXIR
-
-          SCAN_RESULT="$(mix run "$RUNNER_TEMP/hypatia-secret-scan.exs")"
-          echo "$SCAN_RESULT"
-          FINDINGS_COUNT="$(echo "$SCAN_RESULT" | awk -F= '/^secret_findings=/{print $2}' | tail -1)"
-          FINDINGS_COUNT="${FINDINGS_COUNT:-0}"
-          echo "findings_count=$FINDINGS_COUNT" >> "$GITHUB_OUTPUT"
-          echo "Hypatia Elixir secret findings: $FINDINGS_COUNT" >> "$GITHUB_STEP_SUMMARY"
-
-      - name: Upload Hypatia secret findings
-        if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: hypatia-secret-findings
-          path: hypatia-secret-findings.json
-          retention-days: 30
-
-      - name: Dispatch secret alert to gitbot-fleet
-        if: steps.hypatia_ruleset.outputs.findings_count != '0'
-        env:
-          DISPATCH_TOKEN: ${{ secrets.FARM_DISPATCH_TOKEN }}
-          REPO: ${{ github.repository }}
-          REF: ${{ github.ref }}
-          SHA: ${{ github.sha }}
-          RUN_ID: ${{ github.run_id }}
-          FINDINGS_COUNT: ${{ steps.hypatia_ruleset.outputs.findings_count }}
-        run: |
-          set -euo pipefail
-          if [ -z "${DISPATCH_TOKEN:-}" ]; then
-            echo "::warning::FARM_DISPATCH_TOKEN is not configured; skipping gitbot-fleet dispatch."
-            exit 0
-          fi
-
-          cat > payload.json <<EOF
-          {
-            "event_type": "hypatia-secret-alert",
-            "client_payload": {
-              "source_repo": "${REPO}",
-              "ref": "${REF}",
-              "sha": "${SHA}",
-              "run_id": "${RUN_ID}",
-              "findings_count": "${FINDINGS_COUNT}",
-              "artifact": "hypatia-secret-findings"
-            }
-          }
-          EOF
-
-          curl -fsSL \
-            -X POST \
-            -H "Authorization: token ${DISPATCH_TOKEN}" \
-            -H "Accept: application/vnd.github+json" \
-            https://api.github.com/repos/hyperpolymath/gitbot-fleet/dispatches \
-            -d @payload.json
-
-          echo "Dispatched hypatia-secret-alert to gitbot-fleet." >> "$GITHUB_STEP_SUMMARY"
-
-      - name: Block on secret findings
-        if: steps.hypatia_ruleset.outputs.findings_count != '0'
-        run: |
-          echo "::error::Hypatia Elixir ruleset detected ${{ steps.hypatia_ruleset.outputs.findings_count }} secret finding(s)."
-          echo "::error::Secrets must be revoked/rotated and removed before merge."
-          exit 1
-
-  trufflehog:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
-        with:
-          fetch-depth: 0  # Full history for scanning
-
-      - name: TruffleHog Secret Scan
-        id: trufflehog_scan
-        continue-on-error: true
-        uses: trufflesecurity/trufflehog@37b77001d0174ebec2fcca2bd83ff83a6d45a3ab # v3
-        with:
-          # The v3 action injects --fail automatically on pull_request events.
-          # Passing --fail here triggers "flag 'fail' cannot be repeated".
-          extra_args: --only-verified
-
-      - name: Immediate dispatch (TruffleHog finding)
-        if: steps.trufflehog_scan.outcome == 'failure'
-        env:
-          DISPATCH_TOKEN: ${{ secrets.FARM_DISPATCH_TOKEN }}
-          REPO: ${{ github.repository }}
-          REF: ${{ github.ref }}
-          SHA: ${{ github.sha }}
-          RUN_ID: ${{ github.run_id }}
-        run: |
-          set -euo pipefail
-          if [ -z "${DISPATCH_TOKEN:-}" ]; then
-            echo "::warning::FARM_DISPATCH_TOKEN not configured; skipping gitbot-fleet dispatch."
-            exit 0
-          fi
-
-          cat > payload.json <<EOF
-          {
-            "event_type": "secret-scanner-alert",
-            "client_payload": {
-              "scanner": "trufflehog",
-              "source_repo": "${REPO}",
-              "ref": "${REF}",
-              "sha": "${SHA}",
-              "run_id": "${RUN_ID}"
-            }
-          }
-          EOF
-
-          curl -fsSL \
-            -X POST \
-            -H "Authorization: token ${DISPATCH_TOKEN}" \
-            -H "Accept: application/vnd.github+json" \
-            https://api.github.com/repos/hyperpolymath/gitbot-fleet/dispatches \
-            -d @payload.json
-
-      - name: Fail on TruffleHog finding
-        if: steps.trufflehog_scan.outcome == 'failure'
-        run: |
-          echo "::error::TruffleHog detected verified secret(s)."
-          exit 1
-
-  gitleaks:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
-        with:
-          fetch-depth: 0
-
-      - name: Gitleaks Secret Scan
-        id: gitleaks_scan
-        continue-on-error: true
-        uses: gitleaks/gitleaks-action@ff98106e4c7b2bc287b24eaf42907196329070c7 # v2
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Immediate dispatch (Gitleaks finding)
-        if: steps.gitleaks_scan.outcome == 'failure'
-        env:
-          DISPATCH_TOKEN: ${{ secrets.FARM_DISPATCH_TOKEN }}
-          REPO: ${{ github.repository }}
-          REF: ${{ github.ref }}
-          SHA: ${{ github.sha }}
-          RUN_ID: ${{ github.run_id }}
-        run: |
-          set -euo pipefail
-          if [ -z "${DISPATCH_TOKEN:-}" ]; then
-            echo "::warning::FARM_DISPATCH_TOKEN not configured; skipping gitbot-fleet dispatch."
-            exit 0
-          fi
-
-          cat > payload.json <<EOF
-          {
-            "event_type": "secret-scanner-alert",
-            "client_payload": {
-              "scanner": "gitleaks",
-              "source_repo": "${REPO}",
-              "ref": "${REF}",
-              "sha": "${SHA}",
-              "run_id": "${RUN_ID}"
-            }
-          }
-          EOF
-
-          curl -fsSL \
-            -X POST \
-            -H "Authorization: token ${DISPATCH_TOKEN}" \
-            -H "Accept: application/vnd.github+json" \
-            https://api.github.com/repos/hyperpolymath/gitbot-fleet/dispatches \
-            -d @payload.json
-
-      - name: Fail on Gitleaks finding
-        if: steps.gitleaks_scan.outcome == 'failure'
-        run: |
-          echo "::error::Gitleaks detected secret(s)."
-          exit 1
-
-  # Rust-specific: Check for hardcoded crypto values
-  rust-secrets:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
-
-      - name: Check for hardcoded secrets in Rust
-        id: rust_secret_check
-        continue-on-error: true
-        run: |
-          if ! find . -name Cargo.toml -not -path './target/*' -print -quit | grep -q .; then
-            echo 'No Cargo.toml found — skipping Rust secrets check'
-            exit 0
-          fi
-          # Patterns that suggest hardcoded secrets
-          PATTERNS=(
-            'const.*SECRET.*=.*"'
-            'const.*KEY.*=.*"[a-zA-Z0-9]{16,}"'
-            'const.*TOKEN.*=.*"[a-zA-Z0-9\-_]{16,}"'
-            'let.*api_key.*=.*"'
-            'HMAC.*"[a-fA-F0-9]{32,}"'
-            'password.*=.*"[^"]+"'
-          )
-
-          found=0
-          for pattern in "${PATTERNS[@]}"; do
-            if grep -rn --include="*.rs" -E "$pattern" src/ | grep -v "supersecretvalue123"; then
-              echo "WARNING: Potential hardcoded secret found matching: $pattern"
-              found=1
-            fi
-          done
-
-          if [ $found -eq 1 ]; then
-            echo "::error::Potential hardcoded secrets detected. Use environment variables instead."
-            exit 1
-          fi
-
-      - name: Immediate dispatch (Rust secret finding)
-        if: steps.rust_secret_check.outcome == 'failure'
-        env:
-          DISPATCH_TOKEN: ${{ secrets.FARM_DISPATCH_TOKEN }}
-          REPO: ${{ github.repository }}
-          REF: ${{ github.ref }}
-          SHA: ${{ github.sha }}
-          RUN_ID: ${{ github.run_id }}
-        run: |
-          set -euo pipefail
-          if [ -z "${DISPATCH_TOKEN:-}" ]; then
-            echo "::warning::FARM_DISPATCH_TOKEN not configured; skipping gitbot-fleet dispatch."
-            exit 0
-          fi
-
-          cat > payload.json <<EOF
-          {
-            "event_type": "secret-scanner-alert",
-            "client_payload": {
-              "scanner": "rust-secrets",
-              "source_repo": "${REPO}",
-              "ref": "${REF}",
-              "sha": "${SHA}",
-              "run_id": "${RUN_ID}"
-            }
-          }
-          EOF
-
-          curl -fsSL \
-            -X POST \
-            -H "Authorization: token ${DISPATCH_TOKEN}" \
-            -H "Accept: application/vnd.github+json" \
-            https://api.github.com/repos/hyperpolymath/gitbot-fleet/dispatches \
-            -d @payload.json
-
-      - name: Fail on Rust secret finding
-        if: steps.rust_secret_check.outcome == 'failure'
-        run: |
-          echo "::error::Rust hardcoded-secret check failed."
-          exit 1
+  scan:
+    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@3e4bd4c93911750727e2e4c66dff859e00079da0
+    secrets: inherit
