From 938eec9c896bc0d98a332187b5089648975196d3 Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 10 Nov 2026 20:14:23 +0000 Subject: [PATCH] ci: pass only named secrets to the called workflows 3 callers had `secrets: inherit`: hypatia-scan, mirror and secret-scanner. With the owner name `metadatastician`, that line gives every secret of this repository to a workflow of another owner. SonarCloud reports it on this pull request (rule S7635, 3 findings, "Only pass required secrets to this workflow"). The called files at the old pins declare no secrets, so `inherit` was the only way to give them a secret. The owner decided to pass only named secrets: - `hypatia-scan.yml` and `mirror.yml` move from 571cc73 to 740c9d7 (2026-10-19), the commit that echidnabot pins. At that commit the called files declare their secrets. `mirror.yml` passes its 7 key secrets, and `hypatia-scan.yml` passes `HYPATIA_SCAN_PAT`. - `secret-scanner.yml` keeps its pin (db12a6a) and has no `secrets:` line. The called file uses only the automatic token. No caller inherits secrets now. `governance.yml`, `rust-ci.yml` and `scorecard.yml` do not change in this commit. Co-Authored-By: Claude Claude-Session: https://claude.ai/code/session_0136P7ZmiFSCoB3UR9Kk56rK --- .github/workflows/hypatia-scan.yml | 8 +++++--- .github/workflows/mirror.yml | 13 +++++++++++-- .github/workflows/secret-scanner.yml | 2 +- 3 files changed, 17 insertions(+), 6 deletions(-) diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index 6bb7a7a..4d7d324 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -26,6 +26,8 @@ permissions: jobs: hypatia: - uses: metadatastician/standards/.github/workflows/hypatia-scan-reusable.yml@571cc734cd69fb846032ec77a662aa8ee4fc32cd - - secrets: inherit \ No newline at end of file + uses: metadatastician/standards/.github/workflows/hypatia-scan-reusable.yml@740c9d7d4ed4d1f319a04c92b28218beb75668d7 + # Only the secret that the called workflow declares. `secrets: inherit` + # gives every secret of this repository to the called workflow. + secrets: + HYPATIA_SCAN_PAT: ${{ secrets.HYPATIA_SCAN_PAT }} \ No newline at end of file diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml index 794bae7..4d0fec3 100644 --- a/.github/workflows/mirror.yml +++ b/.github/workflows/mirror.yml @@ -11,8 +11,17 @@ permissions: contents: read jobs: mirror: - uses: metadatastician/standards/.github/workflows/mirror-reusable.yml@571cc734cd69fb846032ec77a662aa8ee4fc32cd - secrets: inherit + uses: metadatastician/standards/.github/workflows/mirror-reusable.yml@740c9d7d4ed4d1f319a04c92b28218beb75668d7 + # Only the 7 key secrets that the called workflow declares. `secrets: + # inherit` gives every secret of this repository to the called workflow. + secrets: + GITLAB_SSH_KEY: ${{ secrets.GITLAB_SSH_KEY }} + BITBUCKET_SSH_KEY: ${{ secrets.BITBUCKET_SSH_KEY }} + CODEBERG_SSH_KEY: ${{ secrets.CODEBERG_SSH_KEY }} + SOURCEHUT_SSH_KEY: ${{ secrets.SOURCEHUT_SSH_KEY }} + DISROOT_SSH_KEY: ${{ secrets.DISROOT_SSH_KEY }} + GITEA_SSH_KEY: ${{ secrets.GITEA_SSH_KEY }} + RADICLE_KEY: ${{ secrets.RADICLE_KEY }} permissions: actions: read contents: read diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index d5b3dd0..ad4f4ef 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -21,5 +21,5 @@ jobs: actions: read security-events: write contents: read + # No `secrets:` line. The called workflow uses only the automatic token. uses: metadatastician/standards/.github/workflows/secret-scanner-reusable.yml@db12a6ad3ef9076d5f7bdcf98d7d15cf8547555a - secrets: inherit