From 62cfdc88802ea357b3b70421bb5a985280eb289d Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Tue, 21 Jul 2026 06:46:21 +0100 Subject: [PATCH 1/2] security: re-pin secret scanner onto the real gitleaks gate MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The caller pinned standards' secret-scanner-reusable at @d135b05 (2026-06-24), which is 64 commits behind standards#500. At that pin the gitleaks step carries `continue-on-error: true` — the scan runs, reports success, and cannot fail. This repo's Secret Scanner has therefore been green while being incapable of failing. Re-pinned to @c65436ee, which contains #500: gitleaks now runs as a pinned, checksum-verified binary with `--exit-code 1` and gates for real. Also narrowed the caller's grant to `contents: read`. The new reusable invokes a binary rather than gitleaks-action, so it no longer requests `pull-requests: write` / `actions: read`. Co-Authored-By: Claude Opus 4.8 --- .github/workflows/secret-scanner.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index e2e2af8..75309fa 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -11,7 +11,7 @@ permissions: contents: read jobs: scan: - uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236 + uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@c65436ee3351cd6b0fa14b142938b195efc77586 secrets: inherit trufflehog: runs-on: ubuntu-latest From 1ac8b40b9bab08b87c55dd5053e101aa5b9b475f Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Tue, 21 Jul 2026 14:05:01 +0100 Subject: [PATCH 2/2] =?UTF-8?q?security:=20drop=20the=20local=20trufflehog?= =?UTF-8?q?=20job=20=E2=80=94=20it=20startup=5Ffailures=20the=20whole=20ru?= =?UTF-8?q?n?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bisected on http-capability-gateway 2026-07-21 with two isolation branches: exp/scan-only (reusable only) -> 3 jobs created, run executes exp/trufflehog-only (trufflehog only) -> 0 jobs created, startup_failure startup_failure means no job is ever created, so the Secret Scanner has been reporting nothing at all — not a red, an absence. This repo has had no secret scanning since the pin landed. A required check that never reports is indistinguishable from one still running, which is why this went unnoticed. The action is allowlisted (`trufflesecurity/trufflehog@*` is in patterns_allowed, github_owned_allowed=true), so this is not an Actions-policy rejection; the reference itself fails to resolve at run creation. Removing it loses no coverage: standards' secret-scanner-reusable dropped trufflehog deliberately ("Trufflehog removed: gitleaks provides sufficient coverage at lower cost"), and the reusable's gitleaks + rust-secrets + shell-secrets jobs now run for real on this repo. Co-Authored-By: Claude Opus 4.8 --- .github/workflows/secret-scanner.yml | 10 ---------- 1 file changed, 10 deletions(-) diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index 75309fa..165ecb8 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -13,13 +13,3 @@ jobs: scan: uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@c65436ee3351cd6b0fa14b142938b195efc77586 secrets: inherit - trufflehog: - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v7 - with: - fetch-depth: 0 - - name: TruffleHog Secret Scan - uses: trufflesecurity/trufflehog@main - with: - extra_args: --only-verified --fail