From a1f2286e973ca8d503f07e142c6f8f1d501a87ed Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Tue, 21 Jul 2026 06:32:47 +0100 Subject: [PATCH 1/3] security: re-pin secret scanner onto the real gitleaks gate MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The caller pinned standards' secret-scanner-reusable at @d135b05 (2026-06-24), which is 64 commits behind standards#500. At that pin the gitleaks step carries `continue-on-error: true` — the scan runs, reports success, and cannot fail. This repo's Secret Scanner has therefore been green while being incapable of failing. Re-pinned to @c65436ee, which contains #500: gitleaks now runs as a pinned, checksum-verified binary with `--exit-code 1` and gates for real. Also narrowed the caller's grant to `contents: read`. The new reusable invokes a binary rather than gitleaks-action, so it no longer requests `pull-requests: write` / `actions: read`. Co-Authored-By: Claude Opus 4.8 --- .github/workflows/secret-scanner.yml | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index 0567d6d..2687efe 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -14,9 +14,7 @@ jobs: scan: permissions: contents: read - pull-requests: write - actions: read - uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236 + uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@c65436ee3351cd6b0fa14b142938b195efc77586 secrets: inherit secrets: inherit trufflehog: From 3c937208fa9075ff58260794fc4a7030633fbea5 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Tue, 21 Jul 2026 14:04:52 +0100 Subject: [PATCH 2/3] =?UTF-8?q?security:=20drop=20the=20local=20trufflehog?= =?UTF-8?q?=20job=20=E2=80=94=20it=20startup=5Ffailures=20the=20whole=20ru?= =?UTF-8?q?n?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bisected on http-capability-gateway 2026-07-21 with two isolation branches: exp/scan-only (reusable only) -> 3 jobs created, run executes exp/trufflehog-only (trufflehog only) -> 0 jobs created, startup_failure startup_failure means no job is ever created, so the Secret Scanner has been reporting nothing at all — not a red, an absence. This repo has had no secret scanning since the pin landed. A required check that never reports is indistinguishable from one still running, which is why this went unnoticed. The action is allowlisted (`trufflesecurity/trufflehog@*` is in patterns_allowed, github_owned_allowed=true), so this is not an Actions-policy rejection; the reference itself fails to resolve at run creation. Removing it loses no coverage: standards' secret-scanner-reusable dropped trufflehog deliberately ("Trufflehog removed: gitleaks provides sufficient coverage at lower cost"), and the reusable's gitleaks + rust-secrets + shell-secrets jobs now run for real on this repo. Co-Authored-By: Claude Opus 4.8 --- .github/workflows/secret-scanner.yml | 10 ---------- 1 file changed, 10 deletions(-) diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index 2687efe..d0bfcc7 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -17,13 +17,3 @@ jobs: uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@c65436ee3351cd6b0fa14b142938b195efc77586 secrets: inherit secrets: inherit - trufflehog: - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 - with: - fetch-depth: 0 - - name: TruffleHog Secret Scan - uses: trufflesecurity/trufflehog@main - with: - extra_args: --only-verified --fail \ No newline at end of file From 7254b67df33fd3601f518c0b7548edf49dc3605d Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Tue, 21 Jul 2026 15:51:53 +0100 Subject: [PATCH 3/3] =?UTF-8?q?security:=20fix=20invalid=20workflow=20file?= =?UTF-8?q?=20=E2=80=94=20the=20scanner=20never=20ran=20at=20all?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This repo's Secret Scanner has produced no runs, no checks and no logs. Not a red: an absence. GitHub rejected the workflow file outright, and a rejected workflow is registered under its FILE PATH instead of its `name:` — which is how this was finally identified (the Actions API reports name == '.github/workflows/secret-scanner.yml'). Two invalid constructs, both from copying job-level syntax onto a job that calls a reusable workflow: * `timeout-minutes:` is not permitted on a `uses:` job. The timeout belongs to the callee, which already sets its own per-job values. * a duplicated `secrets: inherit` key. Python's yaml.safe_load accepts duplicate keys (last wins), so local linting passed; the GitHub Actions parser rejects them. A reusable-workflow call accepts only: uses, with, secrets, needs, if, strategy, concurrency, permissions. Also completes the re-pin this branch was opened for: the pin moves to @c65436ee (the real `--exit-code 1` gitleaks gate) and the caller's grant is narrowed to `contents: read`. Verified before push: the file passes a strict YAML load that rejects duplicate keys, and contains no `timeout-minutes` on the `uses:` job. Co-Authored-By: Claude Opus 4.8 --- .github/workflows/secret-scanner.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index d0bfcc7..d239cf1 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -16,4 +16,3 @@ jobs: contents: read uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@c65436ee3351cd6b0fa14b142938b195efc77586 secrets: inherit - secrets: inherit