security: standardize secret scanning on TruffleHog

Author: hyperpolymath

.github/workflows/cargo-audit.yml

@@ -1,7 +1,6 @@
 # SPDX-License-Identifier: MPL-2.0
 # Prevention workflow - audits Rust dependencies for vulnerabilities
 name: Cargo Audit
-
 on:
   push:
     branches: [main]
@@ -13,26 +12,20 @@ on:
       - '**/Cargo.toml'
       - '**/Cargo.lock'
   schedule:
-    - cron: '0 6 * * 1'  # Weekly on Monday
-
+    - cron: '0 6 * * 1' # Weekly on Monday
 permissions: read-all
-
 jobs:
   audit:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
-
       - name: Install cargo-audit
         run: cargo install cargo-audit --locked
-
       - name: Run cargo audit
         run: cargo audit --deny warnings
-
       - name: Check for unmaintained crates
         run: cargo audit --deny unmaintained
-
   # Optional: Create issues for vulnerabilities
   create-issue:
     runs-on: ubuntu-latest
@@ -43,7 +36,6 @@ jobs:
       issues: write
     steps:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
-
       - name: Create vulnerability issue
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/cflite_batch.yml

@@ -4,9 +4,7 @@ on:
   schedule:
     - cron: '0 3 * * 0'
   workflow_dispatch:
-
 permissions: read-all
-
 jobs:
   BatchFuzzing:
     runs-on: ubuntu-latest
@@ -22,7 +20,6 @@ jobs:
         with:
           language: rust
           sanitizer: ${{ matrix.sanitizer }}
-
       - name: Run Fuzzers (${{ matrix.sanitizer }})
         id: run
         uses: google/clusterfuzzlite/actions/run_fuzzers@884713a6c30a92e5e8544c39945cd7cb630abcd1 # v1

.github/workflows/cflite_pr.yml

@@ -3,9 +3,7 @@ name: ClusterFuzzLite PR fuzzing
 on:
   pull_request:
     branches: [main]
-
 permissions: read-all
-
 jobs:
   PR:
     runs-on: ubuntu-latest
@@ -21,7 +19,6 @@ jobs:
         with:
           language: rust
           sanitizer: ${{ matrix.sanitizer }}
-
       - name: Run Fuzzers (${{ matrix.sanitizer }})
         id: run
         uses: google/clusterfuzzlite/actions/run_fuzzers@884713a6c30a92e5e8544c39945cd7cb630abcd1 # v1

.github/workflows/codeql.yml

@@ -1,25 +1,21 @@
 # SPDX-License-Identifier: MPL-2.0
 name: CodeQL Security Analysis
-
 on:
   push:
     branches: [main, master]
   pull_request:
     branches: [main, master]
   schedule:
     - cron: '0 6 * * 1'
-
 # Estate guardrail: cancel superseded runs so re-pushes / rebased PR
 # updates do not pile up queued runs against the shared account-wide
 # Actions concurrency pool. Applied only to read-only check workflows
 # (no publish/mutation), so cancelling a superseded run is always safe.
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
-
 permissions:
   contents: read
-
 jobs:
   analyze:
     runs-on: ubuntu-latest
@@ -33,17 +29,14 @@ jobs:
         include:
           - language: javascript-typescript
             build-mode: none
-
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
       - name: Initialize CodeQL
         uses: github/codeql-action/init@c6f931105cb2c34c8f901cc885ba1e2e259cf745 # v3
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
-
       - name: Perform CodeQL Analysis
         uses: github/codeql-action/analyze@c6f931105cb2c34c8f901cc885ba1e2e259cf745 # v3
         with:

.github/workflows/e2e.yml

@@ -7,16 +7,13 @@
 #   structural — fast, no compiler required (grammar, spec, fixtures, layout)
 #   build-e2e  — full build then E2E (Rust cargo check + OCaml dune build)
 name: E2E Validation
-
 on:
   pull_request:
     branches: ['**']
   push:
     branches: [main, master]
-
 permissions:
   contents: read
-
 jobs:
   # --------------------------------------------------------------------------
   # Job 1: Structural validation (no toolchain needed)
@@ -25,50 +22,40 @@ jobs:
     name: Structural E2E (no-build)
     runs-on: ubuntu-latest
     timeout-minutes: 15
-
     steps:
       - name: Checkout repository
         uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
-
       - name: Run structural E2E checks
         run: E2E_BUILD=0 bash tests/e2e.sh
-
   # --------------------------------------------------------------------------
   # Job 2: Full build + E2E (Rust + OCaml)
   # --------------------------------------------------------------------------
   build-e2e:
     name: Build + E2E (Rust + OCaml)
     runs-on: ubuntu-latest
     timeout-minutes: 15
-
     steps:
       - name: Checkout repository
         uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
-
       # ---- Rust ----
       - name: Install Rust stable toolchain
         uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable
         with:
           components: clippy, rustfmt
-
       - name: Cache Cargo registry and build artefacts
         uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2
-
       # ---- OCaml ----
       - name: Set up OCaml
         uses: ocaml/setup-ocaml@dec6499fef64fc5d7ed43d43a87251b7b1c306f5 # v3
         with:
           ocaml-compiler: 5.1.x
-
       - name: Install opam dependencies
         run: |
           opam install --deps-only --with-test wokelang.opam -y || \
           opam install menhir ounit2 -y
-
       # ---- Full E2E ----
       - name: Run full E2E (with build checks)
         run: E2E_BUILD=1 bash tests/e2e.sh
-
       # ---- Conformance suite ----
       - name: Run conformance test runner
         run: bash tests/run_conformance.sh

.github/workflows/ghcr-publish.yml

@@ -1,29 +1,23 @@
 # SPDX-License-Identifier: MPL-2.0
 name: Publish to GHCR
-
 permissions: read-all
-
 on:
   release:
     types: [published]
   workflow_dispatch:
-
 env:
   REGISTRY: ghcr.io
   IMAGE_NAME: ${{ github.repository }}
-
 jobs:
   build-and-push:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     permissions:
       contents: read
       packages: write
-
     steps:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
-
       - name: Install nerdctl and containerd
         run: |
           sudo apt-get update
@@ -38,21 +32,17 @@ jobs:
 
           sudo /usr/local/bin/buildkitd &
           sleep 3
-
       - name: Log in to GHCR
         run: |
           echo "${{ secrets.GITHUB_TOKEN }}" | sudo nerdctl login ghcr.io -u ${{ github.actor }} --password-stdin
-
       - name: Build image
         run: |
           sudo nerdctl build -f Containerfile -t ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }} .
           sudo nerdctl tag ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }} ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
-
       - name: Push image
         run: |
           sudo nerdctl push ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}
           sudo nerdctl push ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
-
       - name: Tag release version
         if: github.event_name == 'release'
         run: |

.github/workflows/governance.yml

@@ -11,24 +11,20 @@
 # (rust-ci, codeql, dependabot, release, scan/mirror/pages plumbing).
 
 name: Governance
-
 on:
   push:
     branches: [main, master]
   pull_request:
   workflow_dispatch:
-
 # Estate guardrail: cancel superseded runs so re-pushes / rebased PR
 # updates do not pile up queued runs against the shared account-wide
 # Actions concurrency pool. Applied only to read-only check workflows
 # (no publish/mutation), so cancelling a superseded run is always safe.
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
-
 permissions:
   contents: read
-
 jobs:
   governance:
     uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@861b5e911d9e5dcfb3c0ab3dd2a9a3c8fd0a1613

.github/workflows/hypatia-scan.yml

@@ -3,7 +3,6 @@
 # See standards#191 for the reusable's purpose and design.
 
 name: Hypatia Security Scan
-
 on:
   push:
     branches: [main, master, develop]
@@ -12,17 +11,14 @@ on:
   schedule:
     - cron: '0 0 * * 0'
   workflow_dispatch:
-
 # Estate guardrail: cancel superseded runs so re-pushes don't pile up.
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
-
 permissions:
   contents: read
   security-events: write
   pull-requests: write
-
 jobs:
   hypatia:
     uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@6cd3772824e59c8c9affeab66061e25383544242

.github/workflows/instant-sync.yml

@@ -1,16 +1,13 @@
 # SPDX-License-Identifier: MPL-2.0
 # Instant Forge Sync - Triggers propagation to all forges on push/release
 name: Instant Sync
-
 on:
   push:
     branches: [main, master]
   release:
     types: [published]
-
 permissions:
   contents: read
-
 jobs:
   dispatch:
     runs-on: ubuntu-latest
@@ -29,6 +26,5 @@ jobs:
               "sha": "${{ github.sha }}",
               "forges": ""
             }
-
       - name: Confirm
         run: echo "::notice::Propagation triggered for ${{ github.event.repository.name }}"

.github/workflows/mirror.yml

@@ -1,14 +1,11 @@
 # SPDX-License-Identifier: MPL-2.0
 name: Mirror to Git Forges
-
 on:
   push:
     branches: [main]
   workflow_dispatch:
-
 permissions:
   contents: read
-
 jobs:
   mirror:
     uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@e6b2884722350515934d443daf23442f2195796f