security: standardize secret scanning on TruffleHog

Author: hyperpolymath

.build/Justfile

@@ -39,3 +39,6 @@ test:
 # All checks before commit
 pre-commit: build test
     @echo "All checks passed!"
+
+secret-scan-trufflehog:
+    @command -v trufflehog >/dev/null && trufflehog filesystem . --only-verified || true

.github/workflows/casket-pages.yml

@@ -1,40 +1,33 @@
 # SPDX-License-Identifier: MPL-2.0
 name: GitHub Pages
-
 on:
   push:
     branches: [main, master]
   workflow_dispatch:
-
 permissions:
   contents: read
   pages: write
   id-token: write
-
 concurrency:
   group: "pages"
   cancel-in-progress: false
-
 jobs:
   build:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
       - name: Checkout
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
-
       - name: Checkout casket-ssg
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
         with:
           repository: hyperpolymath/casket-ssg
           path: .casket-ssg
-
       - name: Setup GHCup
         uses: haskell-actions/setup@ec49483bfc012387b227434aba94f59a6ecd0900 # v2
         with:
           ghc-version: '9.8.2'
           cabal-version: '3.10'
-
       - name: Cache Cabal
         uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
@@ -43,11 +36,9 @@ jobs:
             ~/.cabal/store
             .casket-ssg/dist-newstyle
           key: ${{ runner.os }}-casket-${{ hashFiles('.casket-ssg/casket-ssg.cabal') }}
-
       - name: Build casket-ssg
         working-directory: .casket-ssg
         run: cabal build
-
       - name: Prepare site source
         shell: bash
         run: |
@@ -90,21 +81,17 @@ jobs:
               echo "Project-specific site content can be added later under site/."
             } > .site-src/index.md
           fi
-
       - name: Build site
         run: |
           mkdir -p _site
           cd .casket-ssg && cabal run casket-ssg -- build ../.site-src ../_site
           touch ../_site/.nojekyll
-
       - name: Setup Pages
         uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5
-
       - name: Upload artifact
         uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3
         with:
           path: '_site'
-
   deploy:
     environment:
       name: github-pages

.github/workflows/ci.yml

@@ -1,21 +1,17 @@
 # SPDX-License-Identifier: MPL-2.0
 permissions:
   contents: read
-
 name: CI/CD Pipeline
-
 on:
   push:
     branches: [main, develop]
   pull_request:
     branches: [main, develop]
   release:
     types: [published]
-
 env:
   JULIA_VERSION: '1.10'
   NODE_VERSION: '20'
-
 jobs:
   lint-julia:
     runs-on: ubuntu-latest
@@ -30,7 +26,6 @@ jobs:
       - name: Check Julia formatting
         run: |
           julia -e 'using JuliaFormatter; format("src/julia", verbose=true, overwrite=false) || exit(1)'
-
   lint-typescript:
     runs-on: ubuntu-latest
     timeout-minutes: 15
@@ -46,7 +41,6 @@ jobs:
         run: npm run lint
       - name: Check Prettier formatting
         run: npx prettier --check "src/**/*.{ts,tsx,js,jsx}"
-
   test-julia:
     runs-on: ubuntu-latest
     timeout-minutes: 15
@@ -73,7 +67,6 @@ jobs:
         with:
           files: lcov.info
           flags: julia
-
   test-typescript:
     runs-on: ubuntu-latest
     timeout-minutes: 15
@@ -92,7 +85,6 @@ jobs:
         with:
           files: ./coverage/cobertura-coverage.xml
           flags: typescript
-
   build:
     runs-on: ubuntu-latest
     timeout-minutes: 15
@@ -126,7 +118,6 @@ jobs:
         with:
           name: libreoffice-extension
           path: dist/uno/economic-toolkit.oxt
-
   security:
     runs-on: ubuntu-latest
     timeout-minutes: 15
@@ -142,7 +133,6 @@ jobs:
         continue-on-error: true
         env:
           SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
-
   docker-build:
     runs-on: ubuntu-latest
     timeout-minutes: 15
@@ -179,7 +169,6 @@ jobs:
           labels: ${{ steps.meta.outputs.labels }}
           cache-from: type=gha
           cache-to: type=gha,mode=max
-
   release:
     runs-on: ubuntu-latest
     timeout-minutes: 15
@@ -209,7 +198,6 @@ jobs:
             dist/uno/economic-toolkit.oxt
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
   coverage-report:
     runs-on: ubuntu-latest
     timeout-minutes: 15

.github/workflows/codeql.yml

@@ -1,25 +1,21 @@
 # SPDX-License-Identifier: MPL-2.0
 name: CodeQL Security Analysis
-
 on:
   push:
     branches: [main, master]
   pull_request:
     branches: [main, master]
   schedule:
-    - cron: '0 6 1 * *'   # monthly 1st 06:00 UTC
-
+    - cron: '0 6 * * 1'
 # Estate guardrail: cancel superseded runs so re-pushes / rebased PR
 # updates do not pile up queued runs against the shared account-wide
 # Actions concurrency pool. Applied only to read-only check workflows
 # (no publish/mutation), so cancelling a superseded run is always safe.
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
-
 permissions:
   contents: read
-
 jobs:
   analyze:
     runs-on: ubuntu-latest
@@ -35,17 +31,14 @@ jobs:
             build-mode: none
           - language: cpp
             build-mode: none
-
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
       - name: Initialize CodeQL
         uses: github/codeql-action/init@c6f931105cb2c34c8f901cc885ba1e2e259cf745 # v3
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
-
       - name: Perform CodeQL Analysis
         uses: github/codeql-action/analyze@c6f931105cb2c34c8f901cc885ba1e2e259cf745 # v3
         with:

.github/workflows/docker-publish.yml

@@ -1,37 +1,30 @@
 # SPDX-License-Identifier: MPL-2.0
 name: Docker Build and Publish
-
 on:
   push:
     branches: [main]
     tags: ['v*']
   pull_request:
     branches: [main]
-
 permissions:
   contents: read
-
 jobs:
   build:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     permissions:
       contents: read
       packages: write
-
     steps:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
-
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@988b5a0280414f521da01fcc63a27aeeb4b104db # v3
-
       - name: Log in to GitHub Container Registry
         uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
-
       - name: Extract metadata
         id: meta
         uses: docker/metadata-action@8e5442c4ef9f78752691e2d8f8d19755c6f78e81 # v5
@@ -43,7 +36,6 @@ jobs:
             type=semver,pattern={{version}}
             type=semver,pattern={{major}}.{{minor}}
             type=semver,pattern={{major}}
-
       - name: Build and push
         uses: docker/build-push-action@5cd11c3a4ced054e52742c5fd54dca954e0edd85 # v6
         with:

.github/workflows/governance.yml

@@ -11,24 +11,20 @@
 # (rust-ci, codeql, dependabot, release, scan/mirror/pages plumbing).
 
 name: Governance
-
 on:
   push:
     branches: [main, master]
   pull_request:
   workflow_dispatch:
-
 # Estate guardrail: cancel superseded runs so re-pushes / rebased PR
 # updates do not pile up queued runs against the shared account-wide
 # Actions concurrency pool. Applied only to read-only check workflows
 # (no publish/mutation), so cancelling a superseded run is always safe.
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
-
 permissions:
   contents: read
-
 jobs:
   governance:
     uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@861b5e911d9e5dcfb3c0ab3dd2a9a3c8fd0a1613