feat(governance): add secret-scanner-reusable.yml — propagate shell-secrets to 281 repos (#190)

## Summary

Extends the reusable-workflow pattern from #168 / #174 / #187 to
**secret-scanner.yml**. Same shape as #187 (no per-call inputs except
`runs-on`; caller uses `secrets: inherit`).

### Why secret-scanner is the next foundational reusable

Estate drift survey (`gh api /search/code` paginated against
`org:hyperpolymath`, blob-SHA grouped over **all 281 deployments**):

| Metric | Value |
|---|---|
| Total deployments | **281** |
| Unique blob SHAs | **54** |
| Structural drift | **19%** (top 4 SHAs cover 69%, top 6 cover 79%) |
| Feature variance | **near-zero** — all sampled variants carry the same
3 jobs (trufflehog + gitleaks + rust-secrets) at 75-81 lines |
| True drift source | action-SHA pin churn + whitespace |

The 100-sample drift estimate (55%) initially ranked secret-scanner
third behind mirror; the full pagination reveals the actual figure is
19%. The variance was a sampling artefact.

### Security debt this PR force-fixes

The `shell-secrets` job was added to the canonical 2026-05-21 (commit
`080c394`) in direct response to the **live Cloudflare API token leak**
via `avow-protocol/deploy-repos.sh` (commit `5f2f8b2`) — a leak that
both `trufflehog --only-verified` and default `gitleaks` missed.

Of 16 estate `secret-scanner.yml` blobs sampled across the top +
long-tail SHAs, **0 carry the `shell-secrets` job**.

The post-incident guardrail intended to catch the *next* such leak has
propagated to nothing. Consolidating the workflow behind this reusable
means the wrapper sweep that follows this PR force-promotes
`shell-secrets` to all 281 repos in one batch.

### Design

- **No per-call inputs other than `runs-on`** — each job self-conditions
internally:
  - `rust-secrets` exits early on no `Cargo.toml` (safe on every repo)
  - `shell-secrets` no-ops without `.sh`/`.bash` files
  - `trufflehog` + `gitleaks` always-on (intended)
- **`secrets: inherit` required at the call site** — so the inner
`secrets.GITHUB_TOKEN` reference in the `gitleaks-action` step resolves.
Without `inherit` it falls back to anonymous mode (rate-limited; misses
some PRs).
- **Caller keeps `on:` + `concurrency:`** — so the read-only
cancel-superseded guardrail stays in the wrapper.
- SPDX header, top-level `permissions: contents: read`, all actions
SHA-pinned — passes the `workflow-lint` job in
`governance-reusable.yml`.

### Caller wrapper shape (post-merge)

```yaml
# SPDX-License-Identifier: PMPL-1.0-or-later
name: Secret Scanner
on:
  pull_request:
  push:
    branches: [main]
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true
permissions:
  contents: read
jobs:
  scan:
    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@<sha>
    secrets: inherit
```

~12 lines per repo, replacing ~75-116 lines.

### Rollout plan

**NOT started in this PR — owner-gated, same as #187 / #174 sweeps.**

| Wave | Repos | Action |
|---|---|---|
| 1: bulk-mechanical | ~275 | Canonical 3-job match. Fan-out
single-commit wrapper PR per repo, pinned to this PR HEAD; rebase to
merged-main SHA before batch firing. |
| 2: slim variants | ~6 | Repos with 2-job (missing `rust-secrets`) or
1-job (`trufflehog` only) older copies. Standardize-up safely since the
missing job self-skips on non-applicable repos. |

Total expected sweep: ~281 PRs (well above the 82-PR rust-ci precedent —
recommend batching by wave; user gates each wave start).

### Pattern hardening

- Same `workflow_call` shape as #168 / #174 / #187 — no new
infrastructure.
- Independent of #174 (`rust-ci-reusable.yml`), #180
(`apply-baseline.sh` glob fix), and #187 (`mirror-reusable.yml`) — no
file conflicts; lands in any order.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Author: hyperpolymath

.github/workflows/secret-scanner-reusable.yml

@@ -0,0 +1,159 @@
+# SPDX-License-Identifier: PMPL-1.0-or-later
+# secret-scanner-reusable.yml — Reusable secret-scanner bundle.
+#
+# Consolidates the per-repo `secret-scanner.yml` workflow (estate-wide:
+# 281 deployments, 54 unique blob SHAs, 19% structural drift — top 4
+# SHAs cover 69% of repos, top 6 cover 79%). Sampled top + long-tail
+# variants all carry the same 3-job structure (trufflehog + gitleaks +
+# rust-secrets) at 75-81 lines; drift is action-SHA / whitespace churn.
+#
+# Critical security debt this PR addresses:
+#   The `shell-secrets` job (added to the canonical 2026-05-21 in
+#   response to the Cloudflare token leak via `avow-protocol/
+#   deploy-repos.sh`, which both `trufflehog --only-verified` and
+#   default gitleaks missed) is currently present in 0 of 16 sampled
+#   estate repos. The post-incident guardrail intended to catch the
+#   *next* leak has propagated to nothing. Consolidating behind this
+#   reusable force-promotes shell-secrets to all 281 repos on the next
+#   wrapper sweep.
+#
+# Design:
+#   - No per-call inputs other than `runs-on`. Each job self-conditions
+#     internally (rust-secrets exits early on no Cargo.toml; shell-secrets
+#     no-ops on no .sh/.bash files), so there is nothing for the caller
+#     to toggle.
+#   - Caller MUST use `secrets: inherit` so the gitleaks-action's
+#     `GITHUB_TOKEN` reference resolves. Without `secrets: inherit`,
+#     the inner `secrets.GITHUB_TOKEN` is empty and gitleaks falls back
+#     to anonymous mode (rate-limited; misses some PRs).
+#   - Caller keeps its own `on:` triggers and `concurrency:` group, so
+#     the read-only cancel-superseded behaviour stays in the wrapper.
+#
+# Caller example (wrapper):
+#   # SPDX-License-Identifier: PMPL-1.0-or-later
+#   name: Secret Scanner
+#   on:
+#     pull_request:
+#     push:
+#       branches: [main]
+#   concurrency:
+#     group: ${{ github.workflow }}-${{ github.ref }}
+#     cancel-in-progress: true
+#   permissions:
+#     contents: read
+#   jobs:
+#     scan:
+#       uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@<sha>
+#       secrets: inherit
+
+name: Secret Scanner (reusable)
+
+on:
+  workflow_call:
+    inputs:
+      runs-on:
+        description: Runner label for all secret-scanner jobs
+        type: string
+        required: false
+        default: ubuntu-latest
+
+permissions:
+  contents: read
+
+jobs:
+  trufflehog:
+    runs-on: ${{ inputs.runs-on }}
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 0  # Full history for scanning
+
+      - name: TruffleHog Secret Scan
+        uses: trufflesecurity/trufflehog@6c05c4a00b91aa542267d8e32a8254774799d68d # v3
+        with:
+          # The v3 action injects --fail automatically on pull_request events.
+          # Passing --fail here triggers "flag 'fail' cannot be repeated".
+          extra_args: --only-verified
+
+  gitleaks:
+    runs-on: ${{ inputs.runs-on }}
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 0
+
+      - name: Gitleaks Secret Scan
+        uses: gitleaks/gitleaks-action@ff98106e4c7b2bc287b24eaf42907196329070c7 # v2
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+  # Rust-specific: hardcoded crypto values. Self-skips when no Cargo.toml
+  # is present, so this job is safe to run on non-Rust repos.
+  rust-secrets:
+    runs-on: ${{ inputs.runs-on }}
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Check for hardcoded secrets in Rust
+        run: |
+          if ! find . -name Cargo.toml -not -path './target/*' -print -quit | grep -q .; then
+            echo 'No Cargo.toml found — skipping Rust secrets check'
+            exit 0
+          fi
+          PATTERNS=(
+            'const.*SECRET.*=.*"'
+            'const.*KEY.*=.*"[a-zA-Z0-9]{16,}"'
+            'const.*TOKEN.*=.*"'
+            'let.*api_key.*=.*"'
+            'HMAC.*"[a-fA-F0-9]{32,}"'
+            'password.*=.*"[^"]+"'
+          )
+
+          found=0
+          for pattern in "${PATTERNS[@]}"; do
+            if grep -rn --include="*.rs" -E "$pattern" src/; then
+              echo "WARNING: Potential hardcoded secret found matching: $pattern"
+              found=1
+            fi
+          done
+
+          if [ $found -eq 1 ]; then
+            echo "::error::Potential hardcoded secrets detected. Use environment variables instead."
+            exit 1
+          fi
+
+  # Shell-specific: catch hardcoded credentials in shell scripts.
+  # Added to canonical 2026-05-21 after trufflehog --only-verified +
+  # gitleaks defaults both missed a real Cloudflare API token leaked
+  # via avow-protocol/deploy-repos.sh. As of this PR, 0 of 16 sampled
+  # estate repos carry this guardrail — the reusable closes that gap.
+  shell-secrets:
+    runs-on: ${{ inputs.runs-on }}
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Check for hardcoded secrets in shell scripts
+        run: |
+          # Patterns: an `export FOO=` or `FOO=` with a quoted literal of meaningful length.
+          # Restricted to *_TOKEN / *_KEY / *_SECRET / PASSWORD to keep false-positives low.
+          PATTERNS=(
+            '(export[[:space:]]+)?[A-Z_]*TOKEN[A-Z_]*=["'"'"'][A-Za-z0-9_./+=-]{20,}["'"'"']'
+            '(export[[:space:]]+)?[A-Z_]*API_KEY[A-Z_]*=["'"'"'][A-Za-z0-9_./+=-]{20,}["'"'"']'
+            '(export[[:space:]]+)?[A-Z_]*SECRET[A-Z_]*=["'"'"'][A-Za-z0-9_./+=-]{16,}["'"'"']'
+            '(export[[:space:]]+)?PASSWORD=["'"'"'][^"'"'"']{6,}["'"'"']'
+          )
+
+          found=0
+          for pattern in "${PATTERNS[@]}"; do
+            if grep -rnE --include='*.sh' --include='*.bash' \
+                 --exclude-dir='.git' --exclude-dir='node_modules' --exclude-dir='target' \
+                 "$pattern" . ; then
+              echo "::warning::Potential hardcoded secret matching: $pattern"
+              found=1
+            fi
+          done
+
+          if [ $found -eq 1 ]; then
+            echo "::error::Hardcoded secret detected in a shell script. Source from env (see avow-protocol/deploy-repos.sh) instead."
+            exit 1
+          fi