chore(ci): replace secret-scanner.yml with reusable wrapper#17
Open
hyperpolymath wants to merge 1 commit into
Open
chore(ci): replace secret-scanner.yml with reusable wrapper#17hyperpolymath wants to merge 1 commit into
hyperpolymath wants to merge 1 commit into
Conversation
Pins to hyperpolymath/standards#190 merge SHA 3e4bd4c93911750727e2e4c66dff859e00079da0. Force-propagates the shell-secrets job (added post-Cloudflare-leak 2026-05-21) to this repo's secret-scanning gate. Replaces ~75-116 lines with a ~14-line wrapper. Part of estate-wide convergence campaign 2026-05-26 (standards#199 / #190).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Replaces this repo's
secret-scanner.yml(~75-116 lines) with a thin ~14-line wrapper callinghyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@3e4bd4c93911750727e2e4c66dff859e00079da0(merged via standards#190).Security debt closed
The
shell-secretsjob (added post-Cloudflare-leak 2026-05-21 in response to the live API-token leak viaavow-protocol/deploy-repos.sh) was carried by 0 of 16 sampled estate copies. This PR brings the guardrail to this repo.Why now
Estate audit: 281 deployments / 54 unique SHAs / 19% true drift. Drift is pin churn + whitespace, feature variance near-zero. Converging behind the reusable means the next post-incident guardrail update propagates via one SHA bump.
secrets: inheritflowsGITHUB_TOKENthrough implicitly sogitleaks-actiondoesn't fall back to anonymous (rate-limited) mode.Part of estate-wide convergence campaign 2026-05-26 (standards#199 / #190).