build(deps): Bump the actions group across 1 directory with 4 updates

.github/workflows/elixir-ci.yml

@@ -76,7 +76,7 @@ jobs:
           key: ${{ runner.os }}-mix-coverage-${{ hashFiles('elixir-orchestration/mix.lock') }}
       - run: mix deps.get
       - run: mix coveralls.json
-      - uses: codecov/codecov-action@v5
+      - uses: codecov/codecov-action@v6
         with:
           files: elixir-orchestration/cover/excoveralls.json
           flags: elixir

.github/workflows/rust-ci.yml

@@ -78,7 +78,7 @@ jobs:
     name: cargo deny
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: EmbarkStudios/cargo-deny-action@v2
         with:
           command: check advisories bans licenses sources
@@ -104,7 +104,7 @@ jobs:
       - uses: taiki-e/install-action@cargo-llvm-cov
       - name: Generate lcov report
         run: cargo llvm-cov --workspace --lcov --output-path lcov.info
-      - uses: codecov/codecov-action@v5
+      - uses: codecov/codecov-action@v6
         with:
           files: lcov.info
           flags: rust
@@ -155,7 +155,7 @@ jobs:
           - fuzz/Cargo.toml
           - rust-core/fuzz/Cargo.toml
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: dtolnay/rust-toolchain@stable
       - uses: Swatinem/rust-cache@v2
       - run: cargo check --manifest-path ${{ matrix.manifest }}

.github/workflows/secret-scanner.yml

@@ -14,6 +14,58 @@ permissions:
   contents: read
 
 jobs:
-  scan:
-    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@3e4bd4c93911750727e2e4c66dff859e00079da0
-    secrets: inherit
+  trufflehog:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
+        with:
+          fetch-depth: 0  # Full history for scanning
+
+      - name: TruffleHog Secret Scan
+        uses: trufflesecurity/trufflehog@37b77001d0174ebec2fcca2bd83ff83a6d45a3ab # v3.95.3
+        with:
+          extra_args: --only-verified --fail
+
+  gitleaks:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
+        with:
+          fetch-depth: 0
+
+      - name: Gitleaks Secret Scan
+        uses: gitleaks/gitleaks-action@ff98106e4c7b2bc287b24eaf42907196329070c7 # v2
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+  # Rust-specific: Check for hardcoded crypto values
+  rust-secrets:
+    runs-on: ubuntu-latest
+    if: hashFiles('**/Cargo.toml') != ''
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
+
+      - name: Check for hardcoded secrets in Rust
+        run: |
+          # Patterns that suggest hardcoded secrets
+          PATTERNS=(
+            'const.*SECRET.*=.*"'
+            'const.*KEY.*=.*"[a-zA-Z0-9]{16,}"'
+            'const.*TOKEN.*=.*"'
+            'let.*api_key.*=.*"'
+            'HMAC.*"[a-fA-F0-9]{32,}"'
+            'password.*=.*"[^"]+"'
+          )
+
+          found=0
+          for pattern in "${PATTERNS[@]}"; do
+            if grep -rn --include="*.rs" -E "$pattern" src/; then
+              echo "WARNING: Potential hardcoded secret found matching: $pattern"
+              found=1
+            fi
+          done
+
+          if [ $found -eq 1 ]; then
+            echo "::error::Potential hardcoded secrets detected. Use environment variables instead."
+            exit 1
+          fi

.github/workflows/security-scan.yml

@@ -14,6 +14,6 @@ permissions:
 
 jobs:
   scan:
-    uses: hyperpolymath/panic-attacker/.github/workflows/scan-and-report.yml@caa407f30505369bb42585a397b6ec85f44d036d # main 2026-05-20
+    uses: hyperpolymath/panic-attacker/.github/workflows/scan-and-report.yml@d449286904ce8a46717ecc9d5014868fff178b81 # main 2026-05-20
     secrets:
       VERISIMDB_PAT: ${{ secrets.VERISIMDB_PAT }}