From 11a77b5b6ae5503e47883b1f3444778e267c6e42 Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Wed, 5 Aug 2026 09:43:22 +0100
Subject: [PATCH] =?UTF-8?q?feat(security):=20add=20gitleaks=20secret=20sca?=
 =?UTF-8?q?nning=20=E2=80=94=20this=20repo=20had=20none?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

An estate-wide audit of secret-scanning coverage found this repository has no
leak detection of any kind: no gitleaks, no trufflehog, nothing.

Measured across all 424 repositories: 170 had gitleaks, 73 had gitleaks plus a
leftover trufflehog step, 33 had trufflehog only, and 88 — this one among them
— had nothing at all.

Adds a caller of the estate's shared secret-scanner reusable, which runs
gitleaks over the whole working tree with --no-git and exits non-zero on a
finding, alongside its rust-secrets and shell-secrets jobs.

Two details that would fail silently if left out:

  - `secrets: inherit` is REQUIRED. Without it the gitleaks action's inner
    secrets.GITHUB_TOKEN is empty and the scan degrades quietly — passing
    while checking less, which is the failure this campaign exists to remove.
  - Where an actions.lock exists it gains a hand-authored [] entry for this
    file. gh actions-lock SKIPS reusable-workflow callers, so without it the
    workflow is rejected as startup_failure with no log and no check run.

Expect findings. A first run on a repository that has never been scanned may
surface real secrets, and any it finds have been exposed for as long as they
have been committed. Treat a red first run as information, not as a fault in
this change — and rotate anything it names rather than only deleting it.

The sweep re-verified from this checkout that no scanner already existed
before writing, rather than trusting the audit that selected the repo.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com>
---
 .github/workflows/secret-scanner.yml | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)
 create mode 100644 .github/workflows/secret-scanner.yml

diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml
new file mode 100644
index 0000000..d325a5c
--- /dev/null
+++ b/.github/workflows/secret-scanner.yml
@@ -0,0 +1,20 @@
+# SPDX-License-Identifier: MPL-2.0
+# Calls the estate's shared secret scanner (gitleaks + rust-secrets +
+# shell-secrets). Added because this repository had NO leak scanning at all.
+#
+# `secrets: inherit` is REQUIRED — without it the gitleaks action's inner
+# secrets.GITHUB_TOKEN is empty and the scan silently degrades.
+name: "Secret Scanner"
+on:
+  pull_request:
+  push:
+    branches: [main, master]
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+permissions:
+  contents: read
+jobs:
+  secret-scan:
+    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4
+    secrets: inherit