…le run

Bisected on http-capability-gateway 2026-07-21 with two isolation branches:

  exp/scan-only        (reusable only)  -> 3 jobs created, run executes
  exp/trufflehog-only  (trufflehog only) -> 0 jobs created, startup_failure

startup_failure means no job is ever created, so the Secret Scanner has been
reporting nothing at all — not a red, an absence. This repo has had no secret
scanning since the pin landed. A required check that never reports is
indistinguishable from one still running, which is why this went unnoticed.

The action is allowlisted (`trufflesecurity/trufflehog@*` is in
patterns_allowed, github_owned_allowed=true), so this is not an Actions-policy
rejection; the reference itself fails to resolve at run creation.

Removing it loses no coverage: standards' secret-scanner-reusable dropped
trufflehog deliberately ("Trufflehog removed: gitleaks provides sufficient
coverage at lower cost"), and the reusable's gitleaks + rust-secrets +
shell-secrets jobs now run for real on this repo.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

This repo's Secret Scanner has produced no runs, no checks and no logs. Not a
red: an absence. GitHub rejected the workflow file outright, and a rejected
workflow is registered under its FILE PATH instead of its `name:` — which is
how this was finally identified (the Actions API reports
name == '.github/workflows/secret-scanner.yml').

Two invalid constructs, both from copying job-level syntax onto a job that
calls a reusable workflow:

  * `timeout-minutes:` is not permitted on a `uses:` job. The timeout
    belongs to the callee, which already sets its own per-job values.
  * a duplicated `secrets: inherit` key. Python's yaml.safe_load accepts
    duplicate keys (last wins), so local linting passed; the GitHub Actions
    parser rejects them.

A reusable-workflow call accepts only: uses, with, secrets, needs, if,
strategy, concurrency, permissions.

Also completes the re-pin this branch was opened for: the pin moves to
@c65436ee (the real `--exit-code 1` gitleaks gate) and the caller's grant is
narrowed to `contents: read`.

Verified before push: the file passes a strict YAML load that rejects
duplicate keys, and contains no `timeout-minutes` on the `uses:` job.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Conflict is main's two invalid constructs, both kept removed on this branch:

  * a duplicated `secrets: inherit` key. GitHub Actions rejects duplicate
    keys outright; Python's yaml.safe_load accepts them (last wins), so local
    linting never caught it.
  * the inline trufflehog job, which creates ZERO jobs and startup_failures
    the whole run (bisected on http-capability-gateway).

Either alone is enough to stop this workflow existing as far as Actions is
concerned — the tell was the Actions API reporting
name == '.github/workflows/secret-scanner.yml' instead of 'Secret Scanner',
which is how GitHub registers a file it cannot parse.

Verified: passes a strict YAML load that rejects duplicate keys AND rejects an
empty/jobless file (a vacuous pass is not a pass).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>