[Pigbibi]

AI assistance

Qoder Agent authored this change while executing the owner-approved P0 governance cleanup plan for this repository. Review is Codex: the risk gate on this repository only counts a Codex review receipt written against the current head commit, and Codex is the reviewer relied on here. No human owner review is claimed by this pull request.

What changed

• Deleted .github/workflows/review-gate.yml. It called QuantStrategyLab/.github/.github/workflows/governance-acceptance.yml@a267ab46389b19c88e552efe64f8f9b1cc7753ff in SHADOW mode, and that shadow engine no longer exists, so the job could only ever fail or report on nothing.
• Deleted .github/workflows/required-gitleaks.yml. Its secret-scan job called the shared gitleaks.yml reusable workflow and duplicated the Gitleaks job that .github/workflows/engineering-governance.yml already runs on every pull request and push to main. weekly-gitleaks.yml is kept because it is the only scheduled full-history scan.

The change is limited to removing dead or duplicated governance workflows. No application code, test, documentation, or other business file is touched.

How verified

• gh api repos/Pigbibi/TelegramAutoSignBot/branches/main/protection confirmed Gitleaks stays required and the duplicate Secret scan / Gitleaks context was removed before this pull request was opened, so deleting required-gitleaks.yml cannot leave a required check with no producer.
• grep -rn "required-gitleaks" . --exclude-dir=.git matched only the file being deleted, so nothing else referenced it.
• grep -n "^ gitleaks:" .github/workflows/engineering-governance.yml reports the surviving Gitleaks job that still scans pull request commits.
• grep -rn "review-gate" . --exclude-dir=.git before the change matched only .github/workflows/review-gate.yml itself, so no workflow, script, or test depended on the file.
• git show --stat HEAD shows 2 files changed, 33 deletions(-).
• gh api repos/Pigbibi/TelegramAutoSignBot/branches/main/protection after the change reports strict=true, enforce_admins=true, and the required contexts Repository hygiene, risk-gate, pr-template, Gitleaks.

Required checks that run on this pull request: Repository hygiene (workflow safety checks plus actionlint), Gitleaks (the gitleaks job in engineering-governance.yml, which scans the pull request commits), Commit message convention, risk-gate and pr-template.

Privacy, permissions or data flow

No secret, credential, token, or user data is added, moved, or exposed. The removed workflows both declared read-only permissions, so no privilege is gained or lost by deleting them. Secret scanning coverage is unchanged: the Gitleaks job in engineering-governance.yml still scans every pull request, and weekly-gitleaks.yml still runs the scheduled full-history scan. Removing the shadow job also stops this repository from sending pull request metadata to a deleted workflow definition in another organisation's repository.

Related issue

There is no separate tracking issue. This pull request is one item of the P0 governance cleanup plan approved by the repository owner, covering the removal of the dead shadow review gate and the duplicate required secret scan.

[chatgpt-codex-connector]

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-07T11:18:02.808095Z	8bd6454	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.