From b6ef08730aca17ca69a57f51f16d3302c81dcccf Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Tue, 21 Jul 2026 06:25:14 +0100 Subject: [PATCH 1/2] fix(ci): grant the secret-scanner reusable its required job permissions MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The scan job calls secret-scanner-reusable.yml, whose gitleaks job declares pull-requests: write (PR summary comment) and actions: read (workflow-run metadata) at job level. A called reusable workflow may only request permissions equal to or more restrictive than its caller, and this caller granted only the file-level contents: read — so GitHub refused the run at parse time. Every Secret Scanner run ended in startup_failure, meaning secret scanning has never actually executed in this repo. Grants the superset at job level, matching the canonical template and the 176 estate repos whose scanner already runs. No SHA pin is changed. Co-Authored-By: Claude Opus 4.8 --- .github/workflows/secret-scanner.yml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index 39a99f3..0fb5dec 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -11,6 +11,13 @@ permissions: contents: read jobs: scan: + # The reusable's gitleaks job requests pull-requests: write (PR summary + # comment) and actions: read (workflow-run metadata) at job level; the + # caller must grant at least that or the run startup-fails. + permissions: + contents: read + pull-requests: write + actions: read uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236 secrets: inherit trufflehog: From 4fd78dab773967c95b6754a60050885960f1bfed Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Tue, 21 Jul 2026 06:33:57 +0100 Subject: [PATCH 2/2] fix(ci): drop the retired inline trufflehog job MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit secret-scanner-reusable.yml deliberately retired TruffleHog as redundant ("gitleaks provides sufficient coverage at lower cost" — see the reusable's header). The inline job survived here, fails, and turns the whole workflow red even when gitleaks, rust-secrets and shell-secrets all pass — so the repo keeps emitting ci_activity notifications after the startup_failure is fixed. Co-Authored-By: Claude Opus 4.8 --- .github/workflows/secret-scanner.yml | 10 ---------- 1 file changed, 10 deletions(-) diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index 0fb5dec..2ffc143 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -20,13 +20,3 @@ jobs: actions: read uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236 secrets: inherit - trufflehog: - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 - with: - fetch-depth: 0 - - name: TruffleHog Secret Scan - uses: trufflesecurity/trufflehog@30d5bb91af1a771378349dbbb0c82129392acf70 # v3.95.6 - with: - extra_args: --only-verified --fail