security: fix rust-secrets — 12.5% of Rust repos were never scanned (#518)

Found while verifying the 201-repo secret-scanner re-pin sweep. Two
defects in `rust-secrets`.

## 1. Silent no-scan — the serious one

```bash
grep -rn --include="*.rs" -E "$pattern" src/     # <- root src/ only
```

A Cargo **workspace** keeps its code in `crates/*/src`, so `src/` does
not exist at the root. `grep` exits **2**, the enclosing `if` reads that
as *no match*, and the job passes.

**Measured across the 64 Rust repos in the sweep: 8 (12.5%) have no root
`src/` and were never scanned at all.**

Proven on a fixture — a planted secret in `crates/core/src/lib.rs`:

| | old job | this PR |
|---|---|---|
| `pub const SERVICE_TOKEN: &str = "…"` in `crates/core/src/lib.rs` |
**exit 0** ✅ green | detected |

Another gate that could not fail.

## 2. False positive on the correct pattern

`let.*api_key.*=.*"` matches any `let api_key =` line containing a quote
— including:

```rust
let api_key = env::var("CLOUDGUARD_API_KEY").ok();
```

…which is *precisely* the practice this job exists to enforce. This was
the **only** `rust-secrets` failure in the entire sweep
(`cloudguard-server` `src/main.rs:59`). A gate whose sole route to green
is to stop reading from the environment is inverted.

## Exemptions

Mirror the four layers already documented on `shell-secrets`, and match
on the **value** or an explicit pragma — **never on a file path**,
because a path exemption blinds the job to a real secret in the same
file (the failure mode `.gitleaks.toml` was rewritten to avoid in #512).

| Layer | Rationale |
|---|---|
| env-lookup RHS | the correct pattern. Anchored to the assignment and
stopped at `;`, so a literal secret with an unrelated `env::var` mention
later on the line **still trips** |
| URL values | an OAuth endpoint is public, not a credential (`const
MS_TOKEN_URL = "https://login.microsoftonline.com/…"` tripped
`const.*TOKEN.*=.*"` 4× in one repo) |
| comment lines | documentation of a pattern is not a live secret |
| `// scanner-allow: rust-secrets` | explicit, per-line, auditable |

## Warn-first on the widened scope

Hits **outside `./src`** are newly visible, so they warn until
**2026-08-21** — the same cutoff and idiom as `check-package-policy.sh`
/ `check-docs-presence.sh` — rather than reddening repos that were never
actually being scanned. Hits **inside `./src`** block exactly as before,
so there is no regression.

The advisory branch prints the finding and says `NOT YET ENFORCED`; it
never claims a pass. A malformed cutoff **refuses to run** rather than
defaulting to warn forever.

## Verified, not assumed

Canary suite run against the script **extracted from this YAML**
(`yaml.safe_load` → execute), not a copy:

```
PASS  env::var + comment + pragma + OAuth URL -> ALLOWED
PASS  secret in ./src                        -> BLOCKS
PASS  secret in crates/                      -> ADVISORY today
PASS  secret in crates/                      -> BLOCKS after cutoff
PASS  literal + env mention after ;          -> BLOCKS  (exemption not over-broad)
PASS  malformed cutoff                       -> refuses to run
6 passed, 0 failed
```

Replayed over **all 64 Rust repos** in the sweep: **0 regressions today,
1 fixed** (`cloudguard-server`).

## Follow-up for repo owners (before 2026-08-21)

Three repos carry fixture-shaped hits outside `./src` and need a
one-line pragma; each is named in the run output today:

- `echidnabot` — `fuzz/fuzz_targets/fuzz_hmac.rs:17` (fuzz corpus)
- `filesoup` — `plugins/secret-scanner/src/lib.rs:159` (the plugin's own
detection fixture)
- `heterogenous-mobile-computing` — `examples/basic_usage.rs:61` (demo
of a *blocked* query)

Pre-existing and unchanged by this PR: `aerie` and `conative-gating`
fail under both old and new (`request["api_key"]` dynamic lookup; a
scanner's own `r#"…"#` test fixtures).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/secret-scanner-reusable.yml

@@ -131,11 +131,50 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Check for hardcoded secrets in Rust
+        env:
+          # Findings outside ./src (newly visible — see the scan-scope note
+          # below) warn until this date, then block. Same warn-then-enforce
+          # idiom and same cutoff as check-package-policy.sh /
+          # check-docs-presence.sh.
+          ENFORCE_RUST_WIDE_SCAN_FROM: '2026-08-21'
         run: |
+          TODAY="${RUST_TODAY:-$(date -u +%Y-%m-%d)}"
+
+          # An unparseable cutoff would pick the warn branch forever, silently
+          # disarming the widened scan. Refuse to run instead.
+          require_date() {
+            case "$2" in
+              [0-9][0-9][0-9][0-9]-[0-1][0-9]-[0-3][0-9]) : ;;
+              *) echo "::error::rust-secrets: $1='$2' is not YYYY-MM-DD."
+                 echo "Refusing to run: an unparseable cutoff would disarm this gate."
+                 exit 1 ;;
+            esac
+          }
+          require_date ENFORCE_RUST_WIDE_SCAN_FROM "$ENFORCE_RUST_WIDE_SCAN_FROM"
+          require_date RUST_TODAY "$TODAY"
+
           if ! find . -name Cargo.toml -not -path './target/*' -print -quit | grep -q .; then
             echo 'No Cargo.toml found — skipping Rust secrets check'
             exit 0
           fi
+
+          # Scan every .rs file, not just ./src. A Cargo workspace keeps its
+          # code in crates/*/src, and the previous `grep … src/` matched
+          # nothing there: grep exits 2 on a missing directory, which the `if`
+          # read as "clean". Measured 2026-07-21 across the 64 Rust repos in
+          # the estate re-pin sweep: 8 (12.5%) have no root src/ and were
+          # therefore never scanned at all — a planted secret in
+          # crates/core/src/lib.rs passed this job silently.
+          mapfile -t FILES < <(find . -name '*.rs' \
+            -not -path './target/*' -not -path '*/target/*' \
+            -not -path './vendor/*' -not -path '*/vendor/*' \
+            -not -path './.git/*' -print)
+          if [ ${#FILES[@]} -eq 0 ]; then
+            echo 'Cargo.toml present but no .rs files — nothing to scan'
+            exit 0
+          fi
+          echo "Scanning ${#FILES[@]} Rust file(s)."
+
           PATTERNS=(
             'const.*SECRET.*=.*"'
             'const.*KEY.*=.*"[a-zA-Z0-9]{16,}"'
@@ -145,18 +184,74 @@ jobs:
             'password.*=.*"[^"]+"'
           )
 
-          found=0
+          # Exemptions, mirroring the four layers already documented on
+          # shell-secrets. All match on the VALUE or on an explicit pragma,
+          # never on a file path: a path-based exemption would blind the job
+          # to a genuine secret in the same file (the failure mode the
+          # .gitleaks.toml allowlist was rewritten to avoid, standards#512).
+          #
+          #  1. env-lookup RHS — `env::var("NAME")` IS the practice this job
+          #     exists to enforce, so flagging it fails the correct code. This
+          #     was the sole rust-secrets failure in the 201-repo sweep:
+          #     cloudguard-server src/main.rs:59,
+          #     `let api_key = env::var("CLOUDGUARD_API_KEY").ok();`. Anchored
+          #     to the assignment and stopped at `;`, so a literal secret with
+          #     an unrelated env::var mention later on the line still trips.
+          #  2. URL values — an OAuth endpoint is public and not a credential.
+          #     `const MS_TOKEN_URL = "https://login.microsoftonline.com/…"`
+          #     tripped `const.*TOKEN.*=.*"` in four places in one repo.
+          #  3. comment lines — documentation of a pattern is not a live secret.
+          #  4. inline pragma `// scanner-allow: rust-secrets`.
+          COMMENT='^[^:]*:[0-9][0-9]*:[[:space:]]*(//|/\*|\*)'
+          ENV_RHS='=[^;]*(env::var|env::var_os|std::env|env!\(|option_env!\(|from_env|dotenv)'
+          URL_RHS='=[[:space:]]*b?"(https?|wss?|ftp)://'
+          PRAGMA='scanner-allow:[[:space:]]*rust-secrets'
+
+          blocking=0
+          advisory=0
           for pattern in "${PATTERNS[@]}"; do
-            if grep -rn --include="*.rs" -E "$pattern" src/; then
+            hits="$(grep -nHE "$pattern" "${FILES[@]}" 2>/dev/null \
+              | grep -vE "$COMMENT" \
+              | grep -vE "$ENV_RHS" \
+              | grep -vE "$URL_RHS" \
+              | grep -vE "$PRAGMA" || true)"
+            [ -n "$hits" ] || continue
+
+            # ./src was the only path the previous version scanned. Hits there
+            # keep blocking exactly as before — no regression. Hits outside it
+            # are newly visible, so they warn until the cutoff rather than
+            # reddening repos that were never actually being scanned.
+            old_scope="$(printf '%s\n' "$hits" | grep -E '^\./src/' || true)"
+            new_scope="$(printf '%s\n' "$hits" | grep -vE '^\./src/' || true)"
+
+            if [ -n "$old_scope" ]; then
+              printf '%s\n' "$old_scope"
               echo "WARNING: Potential hardcoded secret found matching: $pattern"
-              found=1
+              blocking=1
+            fi
+            if [ -n "$new_scope" ]; then
+              printf '%s\n' "$new_scope"
+              if [[ "$TODAY" < "$ENFORCE_RUST_WIDE_SCAN_FROM" ]]; then
+                echo "::warning::Potential hardcoded secret outside ./src matching:" \
+                     "$pattern — becomes BLOCKING on $ENFORCE_RUST_WIDE_SCAN_FROM (today is $TODAY)."
+                advisory=1
+              else
+                echo "WARNING: Potential hardcoded secret found matching: $pattern"
+                blocking=1
+              fi
             fi
           done
 
-          if [ $found -eq 1 ]; then
+          if [ "$blocking" -eq 1 ]; then
             echo "::error::Potential hardcoded secrets detected. Use environment variables instead."
             exit 1
           fi
+          if [ "$advisory" -eq 1 ]; then
+            # Never claim a clean pass while findings are outstanding.
+            echo "NOT YET ENFORCED: findings outside ./src are advisory until $ENFORCE_RUST_WIDE_SCAN_FROM."
+            exit 0
+          fi
+          echo 'No hardcoded secrets detected in Rust sources.'
 
   # Shell-specific: catch hardcoded credentials in shell scripts.
   # Added to canonical 2026-05-21 after default gitleaks missed a real