Skip to content

Commit 3f89b4c

Browse files
committed
security: standardize secret scanning on TruffleHog
1 parent e021a61 commit 3f89b4c

224 files changed

Lines changed: 460 additions & 3426 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

.github/workflows/casket-pages.yml

Lines changed: 0 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,35 +1,28 @@
11
# SPDX-License-Identifier: MPL-2.0
22
name: GitHub Pages
3-
43
on:
54
push:
65
branches: [main, master]
76
workflow_dispatch:
8-
97
permissions:
108
contents: read
119
pages: write
1210
id-token: write
13-
1411
concurrency:
1512
group: "pages"
1613
cancel-in-progress: false
17-
1814
jobs:
1915
build:
2016
runs-on: ubuntu-latest
2117
steps:
2218
- name: Checkout
2319
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
24-
2520
- name: Setup Pages
2621
uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5
27-
2822
- name: Upload artifact
2923
uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3
3024
with:
3125
path: '.'
32-
3326
deploy:
3427
environment:
3528
name: github-pages

.github/workflows/governance.yml

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -11,24 +11,20 @@
1111
# (rust-ci, codeql, dependabot, release, scan/mirror/pages plumbing).
1212

1313
name: Governance
14-
1514
on:
1615
push:
1716
branches: [main, master]
1817
pull_request:
1918
workflow_dispatch:
20-
2119
# Estate guardrail: cancel superseded runs so re-pushes / rebased PR
2220
# updates do not pile up queued runs against the shared account-wide
2321
# Actions concurrency pool. Applied only to read-only check workflows
2422
# (no publish/mutation), so cancelling a superseded run is always safe.
2523
concurrency:
2624
group: ${{ github.workflow }}-${{ github.ref }}
2725
cancel-in-progress: true
28-
2926
permissions:
3027
contents: read
31-
3228
jobs:
3329
governance:
3430
uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@861b5e911d9e5dcfb3c0ab3dd2a9a3c8fd0a1613

.github/workflows/hypatia-scan.yml

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,6 @@
33
# See standards#191 for the reusable's purpose and design.
44

55
name: Hypatia Security Scan
6-
76
on:
87
push:
98
branches: [main, master, develop]
@@ -12,17 +11,14 @@ on:
1211
schedule:
1312
- cron: '0 0 * * 0'
1413
workflow_dispatch:
15-
1614
# Estate guardrail: cancel superseded runs so re-pushes don't pile up.
1715
concurrency:
1816
group: ${{ github.workflow }}-${{ github.ref }}
1917
cancel-in-progress: true
20-
2118
permissions:
2219
contents: read
2320
security-events: write
2421
pull-requests: write
25-
2622
jobs:
2723
hypatia:
2824
uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@6cd3772824e59c8c9affeab66061e25383544242

.github/workflows/package-drift.yml

Lines changed: 2 additions & 84 deletions
Original file line numberDiff line numberDiff line change
@@ -17,23 +17,19 @@
1717
# any package drifts. Owner decides what to do with the report.
1818

1919
name: Package Drift Detection
20-
2120
on:
2221
schedule:
23-
- cron: '17 6 * * 1' # Mondays 06:17 UTC — off-peak, weekly cadence
22+
- cron: '17 6 * * 1' # Mondays 06:17 UTC — off-peak, weekly cadence
2423
workflow_dispatch:
2524
pull_request:
2625
paths:
2726
- 'packages/**'
2827
- '.github/workflows/package-drift.yml'
29-
3028
concurrency:
3129
group: ${{ github.workflow }}-${{ github.ref }}
3230
cancel-in-progress: true
33-
3431
permissions:
3532
contents: read
36-
3733
jobs:
3834
detect-drift:
3935
runs-on: ubuntu-latest
@@ -43,89 +39,11 @@ jobs:
4339
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
4440
with:
4541
path: ecosystem
46-
4742
- name: Compare packages/* against standalone repos
4843
id: drift
4944
env:
5045
GH_OWNER: hyperpolymath
51-
run: |
52-
set -u
53-
cd "$GITHUB_WORKSPACE/ecosystem"
54-
55-
summary="$GITHUB_STEP_SUMMARY"
56-
drift_count=0
57-
identical_count=0
58-
missing_remote=0
59-
60-
{
61-
echo "# Package Drift Detection"
62-
echo
63-
echo "Comparing \`packages/*/\` against \`github.com/${GH_OWNER}/<Pkg>.jl\` HEAD."
64-
echo "Only package-essentials are compared (\`src/\`, \`test/runtests.jl\`, \`Project.toml\`)."
65-
echo "Scaffolding differences (\`flake.nix\`, governance docs, \`benches/\`, etc.) are intentional and ignored."
66-
echo
67-
echo "| Package | Status | Differing essentials |"
68-
echo "|---|---|---|"
69-
} >> "$summary"
70-
71-
tmpdir=$(mktemp -d)
72-
trap 'rm -rf "$tmpdir"' EXIT
73-
74-
for pkgdir in packages/*/; do
75-
pkg=$(basename "$pkgdir")
76-
name="${pkg%.jl}"
77-
standalone="https://github.com/${GH_OWNER}/${pkg}.git"
78-
clone="$tmpdir/$pkg"
79-
80-
if ! git clone --depth 1 --quiet "$standalone" "$clone" 2>/dev/null; then
81-
missing_remote=$((missing_remote + 1))
82-
echo "| \`${name}\` | ⚠️ remote unreachable | (skipped) |" >> "$summary"
83-
continue
84-
fi
85-
86-
differing=()
87-
for rel in "src" "test/runtests.jl" "Project.toml"; do
88-
eco="$pkgdir$rel"
89-
lib="$clone/$rel"
90-
if [ -e "$eco" ] || [ -e "$lib" ]; then
91-
if ! diff -rq "$eco" "$lib" >/dev/null 2>&1; then
92-
differing+=("$rel")
93-
fi
94-
fi
95-
done
96-
97-
if [ ${#differing[@]} -eq 0 ]; then
98-
identical_count=$((identical_count + 1))
99-
echo "| \`${name}\` | ✅ identical (essentials) | — |" >> "$summary"
100-
else
101-
drift_count=$((drift_count + 1))
102-
joined=$(IFS=', '; echo "${differing[*]}")
103-
echo "| \`${name}\` | 🔶 drift | $joined |" >> "$summary"
104-
fi
105-
done
106-
107-
{
108-
echo
109-
echo "## Totals"
110-
echo
111-
echo "- **Drift**: $drift_count"
112-
echo "- **Identical (essentials)**: $identical_count"
113-
echo "- **Remote unreachable**: $missing_remote"
114-
echo
115-
echo "## What to do with this"
116-
echo
117-
echo "Drift in package-essentials means \`src/\`, \`test/runtests.jl\`, or \`Project.toml\` diverged between this monorepo's vendored copy and the standalone repo. Pick the canonical side per package and reconcile:"
118-
echo
119-
echo "- If the standalone is canonical → sync standalone → monorepo by replacing the vendored copy."
120-
echo "- If the monorepo is canonical → push the changed file back to the standalone repo."
121-
echo
122-
echo "This workflow does **not** auto-fix or open PRs; it only reports. See the [2026-05-27 drift audit](https://github.com/hyperpolymath/julia-ecosystem) for context."
123-
} >> "$summary"
124-
125-
echo "drift_count=$drift_count" >> "$GITHUB_OUTPUT"
126-
echo "identical_count=$identical_count" >> "$GITHUB_OUTPUT"
127-
echo "missing_remote=$missing_remote" >> "$GITHUB_OUTPUT"
128-
46+
run: "set -u\ncd \"$GITHUB_WORKSPACE/ecosystem\"\n\nsummary=\"$GITHUB_STEP_SUMMARY\"\ndrift_count=0\nidentical_count=0\nmissing_remote=0\n\n{\n echo \"# Package Drift Detection\"\n echo\n echo \"Comparing \\`packages/*/\\` against \\`github.com/${GH_OWNER}/<Pkg>.jl\\` HEAD.\"\n echo \"Only package-essentials are compared (\\`src/\\`, \\`test/runtests.jl\\`, \\`Project.toml\\`).\"\n echo \"Scaffolding differences (\\`flake.nix\\`, governance docs, \\`benches/\\`, etc.) are intentional and ignored.\"\n echo\n echo \"| Package | Status | Differing essentials |\"\n echo \"|---|---|---|\"\n} >> \"$summary\"\n\ntmpdir=$(mktemp -d)\ntrap 'rm -rf \"$tmpdir\"' EXIT\n\nfor pkgdir in packages/*/; do\n pkg=$(basename \"$pkgdir\")\n name=\"${pkg%.jl}\"\n standalone=\"https://github.com/${GH_OWNER}/${pkg}.git\"\n clone=\"$tmpdir/$pkg\"\n\n if ! git clone --depth 1 --quiet \"$standalone\" \"$clone\" 2>/dev/null; then\n missing_remote=$((missing_remote + 1))\n echo \"| \\`${name}\\` | ⚠️ remote unreachable | (skipped) |\" >> \"$summary\"\n continue\n fi\n\n differing=()\n for rel in \"src\" \"test/runtests.jl\" \"Project.toml\"; do\n eco=\"$pkgdir$rel\"\n lib=\"$clone/$rel\"\n if [ -e \"$eco\" ] || [ -e \"$lib\" ]; then\n if ! diff -rq \"$eco\" \"$lib\" >/dev/null 2>&1; then\n differing+=(\"$rel\")\n fi\n fi\n done\n\n if [ ${#differing[@]} -eq 0 ]; then\n identical_count=$((identical_count + 1))\n echo \"| \\`${name}\\` | ✅ identical (essentials) | — |\" >> \"$summary\"\n else\n drift_count=$((drift_count + 1))\n joined=$(IFS=', '; echo \"${differing[*]}\")\n echo \"| \\`${name}\\` | \U0001F536 drift | $joined |\" >> \"$summary\"\n fi\ndone\n\n{\n echo\n echo \"## Totals\"\n echo\n echo \"- **Drift**: $drift_count\"\n echo \"- **Identical (essentials)**: $identical_count\"\n echo \"- **Remote unreachable**: $missing_remote\"\n echo\n echo \"## What to do with this\"\n echo\n echo \"Drift in package-essentials means \\`src/\\`, \\`test/runtests.jl\\`, or \\`Project.toml\\` diverged between this monorepo's vendored copy and the standalone repo. Pick the canonical side per package and reconcile:\"\n echo\n echo \"- If the standalone is canonical → sync standalone → monorepo by replacing the vendored copy.\"\n echo \"- If the monorepo is canonical → push the changed file back to the standalone repo.\"\n echo\n echo \"This workflow does **not** auto-fix or open PRs; it only reports. See the [2026-05-27 drift audit](https://github.com/hyperpolymath/julia-ecosystem) for context.\"\n} >> \"$summary\"\n\necho \"drift_count=$drift_count\" >> \"$GITHUB_OUTPUT\"\necho \"identical_count=$identical_count\" >> \"$GITHUB_OUTPUT\"\necho \"missing_remote=$missing_remote\" >> \"$GITHUB_OUTPUT\"\n"
12947
- name: Annotate drift
13048
if: steps.drift.outputs.drift_count != '0'
13149
run: |

.machine_readable/contractiles/Justfile

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -70,3 +70,6 @@ crg-badge:
7070
D) color="orange" ;; E) color="red" ;; F) color="critical" ;; \
7171
*) color="lightgrey" ;; esac; \
7272
echo "[![CRG $$grade](https://img.shields.io/badge/CRG-$$grade-$$color?style=flat-square)](https://github.com/hyperpolymath/standards/tree/main/component-readiness-grades)"
73+
74+
secret-scan-trufflehog:
75+
@command -v trufflehog >/dev/null && trufflehog filesystem . --only-verified || true

Justfile

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -70,3 +70,6 @@ crg-badge:
7070
D) color="orange" ;; E) color="red" ;; F) color="critical" ;; \
7171
*) color="lightgrey" ;; esac; \
7272
echo "[![CRG $$grade](https://img.shields.io/badge/CRG-$$grade-$$color?style=flat-square)](https://github.com/hyperpolymath/standards/tree/main/component-readiness-grades)"
73+
74+
secret-scan-trufflehog:
75+
@command -v trufflehog >/dev/null && trufflehog filesystem . --only-verified || true

packages/Axiology.jl/.github/workflows/codeql.yml

Lines changed: 0 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,13 @@
11
# SPDX-License-Identifier: MPL-2.0
22
name: CodeQL Security Analysis
3-
43
on:
54
push:
65
branches: [main, master]
76
pull_request:
87
branches: [main, master]
98
schedule:
109
- cron: '0 6 * * 1'
11-
12-
1310
permissions: read-all
14-
1511
jobs:
1612
analyze:
1713
runs-on: ubuntu-latest
@@ -24,17 +20,14 @@ jobs:
2420
include:
2521
- language: javascript-typescript
2622
build-mode: none
27-
2823
steps:
2924
- name: Checkout
3025
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
31-
3226
- name: Initialize CodeQL
3327
uses: github/codeql-action/init@cdefb33c0f6224e58673d9004f47f7cb3e328b89 # v3.28.1
3428
with:
3529
languages: ${{ matrix.language }}
3630
build-mode: ${{ matrix.build-mode }}
37-
3831
- name: Perform CodeQL Analysis
3932
uses: github/codeql-action/analyze@cdefb33c0f6224e58673d9004f47f7cb3e328b89 # v3.28.1
4033
with:

packages/Axiology.jl/.github/workflows/governance.yml

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -11,16 +11,13 @@
1111
# (rust-ci, codeql, dependabot, release, scan/mirror/pages plumbing).
1212

1313
name: Governance
14-
1514
on:
1615
push:
1716
branches: [main, master]
1817
pull_request:
1918
workflow_dispatch:
20-
2119
permissions:
2220
contents: read
23-
2421
jobs:
2522
governance:
2623
uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@861b5e911d9e5dcfb3c0ab3dd2a9a3c8fd0a1613

0 commit comments

Comments
 (0)