From e667e3356d49d0566053bf09ebf279384bd1d336 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Tue, 21 Jul 2026 06:24:28 +0100 Subject: [PATCH 1/2] fix(ci): grant the secret-scanner reusable its required job permissions MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The scan job calls secret-scanner-reusable.yml, whose gitleaks job declares pull-requests: write (PR summary comment) and actions: read (workflow-run metadata) at job level. A called reusable workflow may only request permissions equal to or more restrictive than its caller, and this caller granted only the file-level contents: read — so GitHub refused the run at parse time. Every Secret Scanner run ended in startup_failure, meaning secret scanning has never actually executed in this repo. Grants the superset at job level, matching the canonical template and the 176 estate repos whose scanner already runs. No SHA pin is changed. Co-Authored-By: Claude Opus 4.8 --- .github/workflows/secret-scanner.yml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index e2e2af8..9d815d1 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -11,6 +11,13 @@ permissions: contents: read jobs: scan: + # The reusable's gitleaks job requests pull-requests: write (PR summary + # comment) and actions: read (workflow-run metadata) at job level; the + # caller must grant at least that or the run startup-fails. + permissions: + contents: read + pull-requests: write + actions: read uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236 secrets: inherit trufflehog: From 56d00208cf2dcc95c6f022724a92042ecb1c4d9b Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Tue, 21 Jul 2026 06:33:32 +0100 Subject: [PATCH 2/2] fix(ci): drop the retired inline trufflehog job MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit secret-scanner-reusable.yml deliberately retired TruffleHog as redundant ("gitleaks provides sufficient coverage at lower cost" — see the reusable's header). The inline job survived here, fails, and turns the whole workflow red even when gitleaks, rust-secrets and shell-secrets all pass — so the repo keeps emitting ci_activity notifications after the startup_failure is fixed. Co-Authored-By: Claude Opus 4.8 --- .github/workflows/secret-scanner.yml | 10 ---------- 1 file changed, 10 deletions(-) diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index 9d815d1..2ffc143 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -20,13 +20,3 @@ jobs: actions: read uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236 secrets: inherit - trufflehog: - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v7 - with: - fetch-depth: 0 - - name: TruffleHog Secret Scan - uses: trufflesecurity/trufflehog@main - with: - extra_args: --only-verified --fail