Ci/caller hygiene secret scanner pages - #542
Merged
Merged
Conversation
secret-scanner.yml was pinned to the reusable at @891b1ed6 (2026-07-06), which is 21 commits behind #500 (08e2d24). At that pin the reusable's gitleaks job still requests `pull-requests: write` + `actions: read`, but this caller grants only `contents: read`. A called workflow cannot exceed its caller's grant, so every run terminated at startup_failure — the last six runs, including every push to main, all startup_failure. Standards' own secret scanning has therefore not executed at all since that pin landed, which is worse than a fake-green gate. Switch to the local relative path `./.github/workflows/secret-scanner-reusable.yml`, mirroring governance.yml. This repo owns the reusable, so it should always scan itself with the current version; a local path also cannot re-stale, so this class of breakage cannot recur here. The current reusable needs only `contents: read`, so the existing grant is already correct. pages.yml (added in #503) had no SPDX header — tripping the governance "missing SPDX header" gate — and four unpinned tag refs, which the estate Actions policy rejects at run creation. Add `MPL-2.0` (this repo's licence, not AGPL) and pin all four to release SHAs, keeping the current majors: checkout v7.0.0, upload-pages-artifact v5.0.0, deploy-pages v5.0.0. spark-theatre-gate.yml: correct a mislabelled pin comment — SHA 9c091bb2 is v7.0.0, not v4. Cosmetic; no behavioural change. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
With the caller unbroken (previous commit), gitleaks actually executes here
for the first time since 2026-07-06 — and reports 15 findings. All 15 are
false positives, verified individually:
* deno.lock x8 — SHA-256 integrity hashes of public registry modules
* Project.toml — a Julia General-registry package UUID
* otpiser audit — a 40-hex OpenPGP fingerprint (published by design)
* haskell design md — the type name in `data Ed25519KeyPair = Ed25519KeyPair`
* example.zig — `abc123def456...`, commented "// Would be real token"
* NEXT-STEPS.md x2 — `1234567890_abc123...` in a fenced terminal mockup
* examples.ndjson — `0a1b2c3d4e5f...`, an ascending-nibble filler walk
This is almost certainly the trap the original `continue-on-error: true` was
papering over: switch the gate on with no allowlist, get a wall of red that
is entirely noise, someone reverts, and the estate is back to a scanner that
cannot fail. So this allowlist is the *unblocker* for re-pinning callers onto
the real gate estate-wide, not merely local cleanup.
Design rule, documented in the file: allowlist by pattern class, anchored to
the whole value; never allowlist a path because "that file is fine" and never
disable a rule. `paths` is confined to formats that cannot hold a live
credential (lockfile integrity hashes, dependency UUIDs).
Every regex is anchored ^...$ deliberately. An earlier draft used unanchored
`(?i)test|example`, and canary-testing caught that it silently allowlisted the
real AWS key wJalrXUtnFEMI/K7MDENG/bPxRfiCY... purely because "EXAMPLE"
appears inside it. Anchoring fixed it. Verified after the rewrite:
standards scan -> no leaks found (exit 0)
planted realistic secrets -> still detected: github-pat, gitlab-pat,
slack-bot-token, stripe-access-token,
generic-api-key (AWS)
Also confirmed to clear all 8 of boj-server-cartridges' equivalent fixture
findings with no repo-specific additions, so it stands up as the estate
baseline template rather than a standards-only patch.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com>
Code Review ✅ ApprovedAdds a Gitleaks allowlist and fixes local relative path workflows to unblock CI secret scanning, along with SHA-pinning GitHub Actions across workflow files. No issues found.
OptionsAuto-apply is off → Gitar will not commit updates to this branch. Comment with these commands to change the behavior for this request:
Was this helpful? React with 👍 / 👎 | Gitar |
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Closes #
Type of change
How has this been verified?
Checklist
git commit -S).SPDX-License-Identifier(code/configMPL-2.0,prose
CC-BY-SA-4.0); I did not relicense existing files.Notes for reviewers
Summary by Gitar
.gitleaks.tomlconfiguration to allowlist estate false positives and unblock the secret scannersecret-scanner.ymlto use a local relative path workflow to fix startup failurespages.ymland updatedspark-theatre-gate.ymlcheckout action versionThis will update automatically on new commits.