security: standardize secret scanning on TruffleHog

Author: hyperpolymath

.github/CODEOWNERS

@@ -0,0 +1,34 @@
+# SPDX-License-Identifier: MPL-2.0
+# CODEOWNERS - Define code review assignments for GitHub
+# See: https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners
+
+# Default: sole maintainer for all files
+* @hyperpolymath
+
+# Security-sensitive files require explicit ownership
+SECURITY.md @hyperpolymath
+.github/workflows/ @hyperpolymath
+.machine_readable/ @hyperpolymath
+contractiles/ @hyperpolymath
+
+# License files
+LICENSE @hyperpolymath
+LICENSES/ @hyperpolymath
+
+# Configuration
+.gitignore @hyperpolymath
+.github/ @hyperpolymath
+
+# Documentation
+README* @hyperpolymath
+CONTRIBUTING* @hyperpolymath
+CODE_OF_CONDUCT* @hyperpolymath
+GOVERNANCE* @hyperpolymath
+MAINTAINERS* @hyperpolymath
+CHANGELOG* @hyperpolymath
+ROADMAP* @hyperpolymath
+
+# Build and CI
+Justfile @hyperpolymath
+Makefile @hyperpolymath
+*.sh @hyperpolymath

.github/workflows/checker-scaling.yml

@@ -8,7 +8,6 @@
 # On Linux it also produces a dhat per-call-site heap profile and uploads it
 # as an artifact for hotspot localisation (the step the issue asked for).
 name: Checker Scaling (#14)
-
 on:
   push:
     paths:
@@ -18,9 +17,7 @@ on:
     paths:
       - 'crates/my-lang/**'
       - '.github/workflows/checker-scaling.yml'
-
 permissions: read-all
-
 jobs:
   scaling:
     name: scaling (${{ matrix.os }})
@@ -34,19 +31,15 @@ jobs:
       contents: read
     steps:
       - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
-
       - name: Setup Rust
         uses: dtolnay/rust-toolchain@f7ccc83f9ed1e5b9c81d8a67d7ad1a747e22a561 # stable
         with:
           toolchain: stable
-
       - name: Run allocation-scaling harness
         run: cargo test -p my-lang --test checker_alloc_scaling --release -- --nocapture
-
       - name: Run dhat heap profile (Linux only)
         if: matrix.os == 'ubuntu-latest'
         run: cargo run -p my-lang --example dhat_checker_profile --features dhat-heap --release
-
       - name: Upload dhat heap profile
         if: matrix.os == 'ubuntu-latest'
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2

.github/workflows/codeql.yml

@@ -1,25 +1,20 @@
 # SPDX-License-Identifier: MPL-2.0
 name: CodeQL Security Analysis
-
 on:
   push:
     branches: [main, master]
   pull_request:
     branches: [main, master]
   schedule:
     - cron: '0 6 * * 1'
-
 # Estate guardrail: cancel superseded runs so re-pushes / rebased PR
 # updates do not pile up queued runs against the shared account-wide
 # Actions concurrency pool. Applied only to read-only check workflows
 # (no publish/mutation), so cancelling a superseded run is always safe.
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
-
-
 permissions: read-all
-
 jobs:
   analyze:
     runs-on: ubuntu-latest
@@ -33,17 +28,14 @@ jobs:
         include:
           - language: actions
             build-mode: none
-
     steps:
       - name: Checkout
         uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
-
       - name: Initialize CodeQL
         uses: github/codeql-action/init@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v3.28.1
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
-
       - name: Perform CodeQL Analysis
         uses: github/codeql-action/analyze@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v3.28.1
         with:

.github/workflows/governance.yml

@@ -11,24 +11,20 @@
 # (rust-ci, codeql, dependabot, release, scan/mirror/pages plumbing).
 
 name: Governance
-
 on:
   push:
     branches: [main, master]
   pull_request:
   workflow_dispatch:
-
 # Estate guardrail: cancel superseded runs so re-pushes / rebased PR
 # updates do not pile up queued runs against the shared account-wide
 # Actions concurrency pool. Applied only to read-only check workflows
 # (no publish/mutation), so cancelling a superseded run is always safe.
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
-
 permissions:
   contents: read
-
 jobs:
   governance:
     uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@861b5e911d9e5dcfb3c0ab3dd2a9a3c8fd0a1613

.github/workflows/hypatia-scan.yml

@@ -3,7 +3,6 @@
 # See standards#191 for the reusable's purpose and design.
 
 name: Hypatia Security Scan
-
 on:
   push:
     branches: [main, master, develop]
@@ -12,17 +11,14 @@ on:
   schedule:
     - cron: '0 0 * * 0'
   workflow_dispatch:
-
 # Estate guardrail: cancel superseded runs so re-pushes don't pile up.
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
-
 permissions:
   contents: read
   security-events: write
   pull-requests: write
-
 jobs:
   hypatia:
     uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@6cd3772824e59c8c9affeab66061e25383544242

.github/workflows/mirror.yml

@@ -1,14 +1,11 @@
 # SPDX-License-Identifier: MPL-2.0
 name: Mirror to Git Forges
-
 on:
   push:
     branches: [main]
   workflow_dispatch:
-
 permissions:
   contents: read
-
 jobs:
   mirror:
     uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@e6b2884722350515934d443daf23442f2195796f

.github/workflows/scorecard.yml

@@ -1,15 +1,12 @@
 # SPDX-License-Identifier: MPL-2.0
 name: Scorecards supply-chain security
-
 on:
   branch_protection_rule:
   schedule:
     - cron: '23 4 * * 1'
   push:
     branches: [main]
-
 permissions: read-all
-
 jobs:
   analysis:
     uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@e0caf11508a3989574713c78f5f444f2ce5e33ef

.github/workflows/secret-scanner.yml

@@ -1,20 +1,26 @@
 # SPDX-License-Identifier: MPL-2.0
 name: Secret Scanner
-
 on:
   pull_request:
   push:
     branches: [main]
-
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
-
 permissions:
   contents: read
-
 jobs:
   scan:
     uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@3e4bd4c93911750727e2e4c66dff859e00079da0
     timeout-minutes: 10
     secrets: inherit
+  trufflehog:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: TruffleHog Secret Scan
+        uses: trufflesecurity/trufflehog@main
+        with:
+          extra_args: --only-verified --fail

.github/workflows/spark-theatre-gate.yml

@@ -4,15 +4,12 @@
 # estate action-pinning policy. Regenerate the pin only when the reusable
 # workflow is intentionally bumped.
 name: SPARK Theatre Gate
-
 on:
   pull_request:
   push:
     branches: [main, master]
-
 permissions:
   contents: read
-
 jobs:
   spark-theatre-gate:
     uses: hyperpolymath/standards/.github/workflows/spark-theatre-gate.yml@462003782f3ebb93ea763e81d0d199ce13ef7d73

.github/workflows/stack-depth.yml

@@ -14,7 +14,6 @@
 # the 1 MiB floor with headroom — so the Windows datapoint is produced *and*
 # locked in on every change instead of relying on a manual run.
 name: Stack Depth (#37)
-
 on:
   push:
     paths:
@@ -24,9 +23,7 @@ on:
     paths:
       - 'crates/my-lang/**'
       - '.github/workflows/stack-depth.yml'
-
 permissions: read-all
-
 jobs:
   measure:
     name: measure (${{ matrix.os }})
@@ -40,14 +37,11 @@ jobs:
       contents: read
     steps:
       - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
-
       - name: Setup Rust
         uses: dtolnay/rust-toolchain@f7ccc83f9ed1e5b9c81d8a67d7ad1a747e22a561 # stable
         with:
           toolchain: stable
-
       - name: Stack-depth regression test (#37 subtleties 1 & 3)
         run: cargo test -p my-lang --test stack_depth_37 --release -- --nocapture
-
       - name: Measure stack budget and assert MAX_EXPR_DEPTH fits the 1 MiB floor
         run: cargo run -p my-lang --example measure_depth --release