diff --git a/.github/workflows/language-gates-self-test.yml b/.github/workflows/language-gates-self-test.yml index c31fede..26d9152 100644 --- a/.github/workflows/language-gates-self-test.yml +++ b/.github/workflows/language-gates-self-test.yml @@ -26,6 +26,8 @@ on: - "scripts/verify-suite-checkout.sh" - "scripts/deonboard-workflow.sh" - "tests/gate-action-owners.sh" + - "tests/inspect-pr-ci.sh" + - "scripts/inspect-pr-ci.sh" - ".github/workflows/rust-ci.yml" - ".github/workflows/creusot-gate.yml" - ".github/workflows/spark-gate.yml" @@ -41,6 +43,8 @@ on: - "scripts/verify-suite-checkout.sh" - "scripts/deonboard-workflow.sh" - "tests/gate-action-owners.sh" + - "tests/inspect-pr-ci.sh" + - "scripts/inspect-pr-ci.sh" - ".github/workflows/rust-ci.yml" - ".github/workflows/creusot-gate.yml" - ".github/workflows/spark-gate.yml" @@ -92,6 +96,8 @@ jobs: rc=0; EXPECTED=0000000000000000000000000000000000000000 SUITE_DIR=. bash scripts/verify-suite-checkout.sh || rc=$? [ "$rc" -eq 2 ] || { echo "verifier accepted a wrong SHA (rc=$rc)"; exit 1; } EXPECTED="$(git rev-parse HEAD)" SUITE_DIR=. bash scripts/verify-suite-checkout.sh + - name: PR evidence collector refuses invisible-green and denied-probe assumptions + run: bash tests/inspect-pr-ci.sh - name: Rust gate run: bash actions/rust-ci-check/test.sh - name: Creusot gate diff --git a/.github/workflows/secret-scanner-legacy.yml b/.github/workflows/secret-scanner-legacy.yml new file mode 100644 index 0000000..ff7d46a --- /dev/null +++ b/.github/workflows/secret-scanner-legacy.yml @@ -0,0 +1,28 @@ +# Canary safety: retained for Rust/shell coverage comparison; not scan / gitleaks. +# SPDX-License-Identifier: MPL-2.0 +# Prevention workflow - scans for hardcoded secrets before they reach main. +# +# Calls the estate's shared secret scanner (gitleaks + rust-secrets + +# shell-secrets). The job key MUST stay `scan`: the estate-wide +# Secret-Scan-Floor ruleset requires the check context `scan / gitleaks`. +# +# No `secrets:` line, deliberately: the reusable references no secrets +# (gitleaks runs as a checksum-verified binary, not gitleaks-action), so +# `secrets: inherit` would only hand it every repo and org secret (CWE-250). +name: Legacy secret scanner (coverage comparison) + +on: + pull_request: + push: + branches: [main] + +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + +permissions: + contents: read + +jobs: + legacy: + uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@74d2f66f575246cf6e313ae7775f44df6e097ff2 diff --git a/.github/workflows/secret-scanner-reusable.yml b/.github/workflows/secret-scanner-reusable.yml new file mode 100644 index 0000000..6981d9e --- /dev/null +++ b/.github/workflows/secret-scanner-reusable.yml @@ -0,0 +1,82 @@ +# SPDX-License-Identifier: MPL-2.0 +# Single required context remains scan / gitleaks in direct callers. +name: Bounded secret scanner (reusable) +on: + workflow_call: + inputs: + fast-pr: + description: Security-owner-approved introduced-commit PR scan; non-PR runs always scan full history + type: boolean + default: false +permissions: + contents: read +jobs: + gitleaks: + runs-on: ubuntu-24.04 + timeout-minutes: 15 + permissions: + contents: read + defaults: + run: + shell: bash + steps: + - name: Check out subject and complete ancestry + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + ref: ${{ github.event.pull_request.head.sha || github.sha }} + path: subject + fetch-depth: 0 + persist-credentials: false + - name: Resolve exact suite pin from the direct scan caller + id: suite + env: + CALLER_REF: ${{ github.workflow_ref }} + CALLER_REPO: ${{ github.repository }} + run: | + set -euo pipefail + file="${CALLER_REF#"$CALLER_REPO"/}"; file="${file%@*}" + case "$file" in .github/workflows/*.yml|.github/workflows/*.yaml) ;; *) exit 2 ;; esac + ref=$(yq -r '.jobs.scan.uses' "subject/$file") + prefix=hyperpolymath/cicd-suite/.github/workflows/secret-scanner-reusable.yml@ + [[ $ref == "$prefix"* ]] || { echo '::error::requires a direct scan caller'; exit 2; } + sha=${ref#"$prefix"} + [[ $sha =~ ^[0-9a-f]{40}$ ]] || { echo '::error::caller must pin a full SHA'; exit 2; } + echo "sha=$sha" >> "$GITHUB_OUTPUT" + - name: Check out pinned scanner implementation outside subject + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + repository: hyperpolymath/cicd-suite + ref: ${{ steps.suite.outputs.sha }} + path: suite + persist-credentials: false + - name: Verify pinned checkout and install checksum-pinned Gitleaks + env: + EXPECTED: ${{ steps.suite.outputs.sha }} + run: | + set -euo pipefail + [[ $(git -C suite rev-parse HEAD) == "$EXPECTED" ]] || exit 2 + bash suite/actions/secret-scan-check/install.sh "$RUNNER_TEMP/suite-gitleaks" + - name: Run real detector controls before trusting the scan + env: + GITLEAKS_BIN: ${{ runner.temp }}/suite-gitleaks/gitleaks + run: bash suite/actions/secret-scan-check/control.sh + - name: Scan subject (bounded, redacted, both populations) + env: + GITLEAKS_BIN: ${{ runner.temp }}/suite-gitleaks/gitleaks + SUBJECT: ${{ github.workspace }}/subject + ESTATE_BASELINE: ${{ github.workspace }}/suite/config/gitleaks/estate-baseline.toml + FAST_PR: ${{ inputs.fast-pr }} + EVENT: ${{ github.event_name }} + PR_BASE: ${{ github.event.pull_request.base.sha }} + PR_HEAD: ${{ github.event.pull_request.head.sha }} + run: | + set -euo pipefail + export SCAN_MODE=full SCAN_TIMEOUT_SECONDS=180 + if [[ "$EVENT" == pull_request && "$FAST_PR" == true ]]; then + export SCAN_MODE=pr-range HEAD_SHA="$PR_HEAD" + # A PR may be behind the base tip: scan from their common ancestor, + # not from the final file diff and not from a guessed depth. + export BASE_SHA + BASE_SHA=$(git -C "$SUBJECT" merge-base "$PR_BASE" "$PR_HEAD") + fi + bash suite/actions/secret-scan-check/check.sh diff --git a/.github/workflows/secret-scanner-self-test.yml b/.github/workflows/secret-scanner-self-test.yml new file mode 100644 index 0000000..2d9f7e4 --- /dev/null +++ b/.github/workflows/secret-scanner-self-test.yml @@ -0,0 +1,36 @@ +# SPDX-License-Identifier: MPL-2.0 +name: Bounded secret scanner controls +on: + push: + pull_request: +permissions: + contents: read +concurrency: + group: secret-controls-${{ github.ref }} + cancel-in-progress: true +jobs: + controls: + runs-on: ubuntu-24.04 + timeout-minutes: 10 + steps: + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + - name: Shell and YAML syntax + shell: bash + run: | + set -euo pipefail + for f in actions/secret-scan-check/*.sh; do bash -n "$f"; done + yq '.' .github/workflows/secret-scanner-reusable.yml >/dev/null + yq '.' templates/secret-scanner-caller.yml >/dev/null + yq '.' actions/secret-scan-check/action.yml >/dev/null + - name: Shell/control-flow fixtures and vacuous-scanner mutant + run: bash actions/secret-scan-check/test.sh + - name: Install the pinned real scanner + run: bash actions/secret-scan-check/install.sh "$RUNNER_TEMP/suite-gitleaks" + - name: Repeat fixtures against the real detector (not a stand-in) + env: + GITLEAKS_BIN: ${{ runner.temp }}/suite-gitleaks/gitleaks + run: bash actions/secret-scan-check/test.sh + - name: Evidence collector controls + run: bash tests/inspect-pr-ci.sh diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index fa6eb1f..5fc9dd2 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -1,27 +1,23 @@ # SPDX-License-Identifier: MPL-2.0 -# Prevention workflow - scans for hardcoded secrets before they reach main. -# -# Calls the estate's shared secret scanner (gitleaks + rust-secrets + -# shell-secrets). The job key MUST stay `scan`: the estate-wide -# Secret-Scan-Floor ruleset requires the check context `scan / gitleaks`. -# -# No `secrets:` line, deliberately: the reusable references no secrets -# (gitleaks runs as a checksum-verified binary, not gitleaks-action), so -# `secrets: inherit` would only hand it every repo and org secret (CWE-250). +# Keep scan / gitleaks: required by the estate Secret-Scan-Floor ruleset. name: Secret Scanner - on: pull_request: push: branches: [main] - -concurrency: - group: ${{ github.workflow }}-${{ github.ref }} - cancel-in-progress: true - + schedule: + - cron: '23 3 * * 2' + workflow_dispatch: permissions: contents: read - +concurrency: + # Scheduled/full audits and PR cancellation do not cancel one another. + group: secrets-${{ github.event_name }}-${{ github.ref }} + cancel-in-progress: true jobs: scan: - uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@74d2f66f575246cf6e313ae7775f44df6e097ff2 + uses: hyperpolymath/cicd-suite/.github/workflows/secret-scanner-reusable.yml@50dc27f47e39f7ac046596c071ed4ea80b4989e0 + with: + # Keep false until an initial full audit passes and the security owner + # accepts introduced-commit PR coverage. All non-PR runs remain full. + fast-pr: false diff --git a/README.adoc b/README.adoc index 19c9cf0..4bce9bb 100644 --- a/README.adoc +++ b/README.adoc @@ -129,9 +129,10 @@ them is a rename to `+*-advisory+`, not teeth. longer runs them.* * `+semantic-audit+` is pure `+echo+` with "`Placeholder for actual -invocation`"; its real body is `+cicd-squabbler audit --semantic+`, and -*`+cicd-squabbler+` does not exist yet*. It cannot be implemented, only -parked. +invocation`". `+cicd-squabbler+` now exists, but is a gate diagnosis +and legitimate-remediation engine, not evidence of the imagined +`+audit --semantic+` interface. Keep this stub out of enforcement; do not +confuse pipeline diagnosis with semantic verification. * `+prat+` claims to validate "`PRAT testing`", but *PRAT is defined nowhere in the estate* — a search of every repository turns up only further copies of the workflow that calls it. Its current check passes @@ -389,3 +390,46 @@ this repository's own CI can witness them; both are now guarded here. === Licence Code MPL-2.0, prose CC-BY-SA-4.0. See link:LICENSE[`+LICENSE+`]. + +=== Merge-blocker diagnosis and secret-scan latency + +`+bash scripts/inspect-pr-ci.sh OWNER/REPO PR_NUMBER+` collects read-only +JSON evidence: PR checks, effective branch rules, classic protection, +head-SHA workflow runs and jobs, including failed workflows with zero jobs. +Requires `+gh+` and `+jq+`; exit 2 means collection did not complete, including +invalid arguments, missing `+gh+` or `+jq+`, and denied API probes. Exit 0 +means collection succeeded, *not* that CI passed. +The report is not merge authorisation, a full check-history export, or an +implementation of cicd-squabbler. Use squabbler for attribution and repair. +No logs, artifacts, secrets, policy edits, reruns or merges are requested. + +See link:docs/CI-TRIAGE-2026-10-30.adoc[the sampled estate diagnosis] and +link:docs/SECRET-SCAN-PERFORMANCE.adoc[the secret-scan latency investigation +and implementation handoff]. No replacement scanner has been deployed. + +=== Bounded secret scanner (canary, not estate-deployed) + +`+.github/workflows/secret-scanner-reusable.yml+` and +`+actions/secret-scan-check/+` provide a checksum-pinned Gitleaks 8.30.1 +implementation with bounded download/scan deadlines, redacted logs, +real detector controls using the effective configuration, and separate +working-tree/history passes. The vendored estate baseline records its +upstream SHA; no renamed standards reusable is needed at runtime. + +The direct caller template preserves `+scan / gitleaks+`. Full history +remains the default. `+fast-pr: true+` explicitly opts PRs into scanning +all introduced commits, not merely the final diff; non-PR runs remain full. +PR scans use the base commit's configuration and extensions; extensions must +stay within that tree. A changed `+.gitleaksignore+` fails the scan. PR scans +require Python 3.11 or newer to validate configuration paths. +A full ancestry checkout is still required: this version reduces scanning +work, not checkout history size. No speed claim is established without +runner measurements. The job deadline is 15 minutes; each main scan is +bounded to 180 seconds plus termination grace. Oversized audits fail visibly +rather than wait forever or silently pass. + +Do not bulk-replace the old three-job standards bundle yet: this scanner +is not claimed to reproduce its specialised Rust/shell heuristic checks. +Keep those protections until parity controls or an owner-approved migration +exist. The real-binary CI controls and a caller canary must pass before +production rollout; see link:docs/SECRET-SCANNER-ROLLOUT.adoc[rollout status]. diff --git a/actions/secret-scan-check/action.yml b/actions/secret-scan-check/action.yml new file mode 100644 index 0000000..46bf90e --- /dev/null +++ b/actions/secret-scan-check/action.yml @@ -0,0 +1,35 @@ +# SPDX-License-Identifier: MPL-2.0 +name: Bounded secret scan +description: Redacted tree and history scan with pinned Gitleaks, live controls and explicit infrastructure failure +inputs: + path: + description: Complete subject repository checkout (no shallow history) + default: '.' + mode: + description: full (default) or security-owner-approved pr-range + default: full + base-sha: + description: Verified ancestor commit for pr-range + default: '' + head-sha: + description: Expected checked-out head commit for pr-range + default: '' +runs: + using: composite + steps: + - name: Install and execute the bounded scanner + shell: bash + env: + ACTION_DIR: ${{ github.action_path }} + SUBJECT: ${{ inputs.path }} + SCAN_MODE: ${{ inputs.mode }} + BASE_SHA: ${{ inputs.base-sha }} + HEAD_SHA: ${{ inputs.head-sha }} + PR_BASE: ${{ github.event.pull_request.base.sha }} + PR_HEAD: ${{ github.event.pull_request.head.sha }} + run: | + set -euo pipefail + bash "$ACTION_DIR/install.sh" "$RUNNER_TEMP/suite-gitleaks" + export GITLEAKS_BIN="$RUNNER_TEMP/suite-gitleaks/gitleaks" + export ESTATE_BASELINE="$ACTION_DIR/../../config/gitleaks/estate-baseline.toml" + bash "$ACTION_DIR/check.sh" diff --git a/actions/secret-scan-check/check.sh b/actions/secret-scan-check/check.sh new file mode 100644 index 0000000..1ed7bc2 --- /dev/null +++ b/actions/secret-scan-check/check.sh @@ -0,0 +1,136 @@ +#!/usr/bin/env bash +# SPDX-License-Identifier: MPL-2.0 +# 0 = both scans passed; 1 = findings; 2 = no trustworthy verdict. +# Inputs are environment variables, never interpolated shell fragments. +set -euo pipefail +script_dir=$(cd "$(dirname "$0")" && pwd) +subject=$(realpath "${SUBJECT:-.}") +scanner=$(realpath "${GITLEAKS_BIN:?GITLEAKS_BIN is required}") +baseline=$(realpath "${ESTATE_BASELINE:?ESTATE_BASELINE is required}") +mode=${SCAN_MODE:-full} +seconds=${SCAN_TIMEOUT_SECONDS:-180} +[[ $mode == full || $mode == pr-range ]] || { echo 'invalid scan mode' >&2; exit 2; } +[[ $seconds =~ ^[1-9][0-9]*$ && $seconds -le 600 ]] || { echo 'invalid scan deadline (1..600 seconds)' >&2; exit 2; } +[[ -x $scanner && -s $baseline ]] || { echo 'missing scanner or baseline' >&2; exit 2; } +cd "$subject" +[[ $(git rev-parse --show-toplevel) == "$subject" ]] || { echo 'subject must be repository root' >&2; exit 2; } +[[ $(git rev-parse --is-shallow-repository) == false ]] || { echo 'incomplete ancestry: refusing shallow history' >&2; exit 2; } +head=$(git rev-parse HEAD) +trusted_dir= +# Remove the estate baseline on exit only when this scan staged it. +cleanup() { + if [[ ${staged:-0} == 1 ]]; then rm -f "$subject/.gitleaks-estate.toml"; fi + if [[ -n $trusted_dir ]]; then rm -rf "$trusted_dir"; fi +} +trap cleanup EXIT +scan_dir=$subject +if [[ ${GITHUB_EVENT_NAME:-} == pull_request ]]; then + pr_base=${PR_BASE:-} pr_head=${PR_HEAD:-} + [[ $pr_base =~ ^[0-9a-f]{40}$ && $pr_head =~ ^[0-9a-f]{40}$ && $head == "$pr_head" ]] \ + || { echo 'invalid PR base/head or checkout does not match PR head' >&2; exit 2; } + git cat-file -e "$pr_base^{commit}" || exit 2 + # Gitleaks also loads .gitleaksignore from the scan source automatically. + # Refuse changed, untracked, or symlinked ignore files on PRs. + if git cat-file -e "$pr_base:.gitleaksignore" 2>/dev/null; then + [[ $(git ls-tree "$pr_base" -- .gitleaksignore) == '100644 blob '* || $(git ls-tree "$pr_base" -- .gitleaksignore) == '100755 blob '* ]] \ + && [[ -f .gitleaksignore && ! -L .gitleaksignore ]] \ + && git show "$pr_base:.gitleaksignore" | cmp -s - .gitleaksignore \ + || { echo 'PR ignore file differs from trusted base' >&2; exit 2; } + elif [[ -e .gitleaksignore || -L .gitleaksignore ]]; then + echo 'PR ignore file differs from trusted base' >&2; exit 2 + fi + # Extended config paths are resolved from the current directory. Materialize + # the base tree outside the subject so PR files cannot supply those paths. + trusted_dir=$(mktemp -d) + mkdir "$trusted_dir/tree" + GIT_INDEX_FILE="$trusted_dir/index" git read-tree "$pr_base" + GIT_INDEX_FILE="$trusted_dir/index" git --work-tree="$trusted_dir/tree" checkout-index --all + scan_dir=$trusted_dir/tree +fi +log_opts='--all' +population=$(git rev-list --all --count) +if [[ $mode == pr-range ]]; then + base=${BASE_SHA:-} expected_head=${HEAD_SHA:-} + [[ $base =~ ^[0-9a-f]{40}$ && $expected_head =~ ^[0-9a-f]{40}$ && $head == "$expected_head" ]] \ + || { echo 'invalid base/head or checkout does not match PR head' >&2; exit 2; } + git cat-file -e "$base^{commit}" || exit 2 + git merge-base --is-ancestor "$base" "$head" || { echo 'base is not an ancestor; full scan required' >&2; exit 2; } + # Every introduced commit, not only the final diff. A secret added and + # deleted within the PR remains in this population. + log_opts="$base..$head" + population=$(git rev-list --count "$log_opts") +fi +# Shared config matches the pinned suite revision. Keep consumer-specific +# exceptions, but do not silently overwrite an existing baseline or symlink. +staged=0 +if [[ -e .gitleaks-estate.toml || -L .gitleaks-estate.toml ]]; then + [[ ! -L .gitleaks-estate.toml ]] && cmp -s "$baseline" .gitleaks-estate.toml \ + || { echo 'existing estate baseline differs; explicit migration required' >&2; exit 2; } +else + cp "$baseline" .gitleaks-estate.toml + staged=1 +fi +config=.gitleaks-estate.toml +if [[ $scan_dir != "$subject" ]]; then + if [[ -e $scan_dir/.gitleaks-estate.toml || -L $scan_dir/.gitleaks-estate.toml ]]; then + [[ ! -L $scan_dir/.gitleaks-estate.toml ]] && cmp -s "$baseline" "$scan_dir/.gitleaks-estate.toml" \ + || { echo 'trusted estate baseline differs; explicit migration required' >&2; exit 2; } + else + cp "$baseline" "$scan_dir/.gitleaks-estate.toml" + fi +fi +if [[ -f $scan_dir/.gitleaks.toml || ( $scan_dir != "$subject" && -L $scan_dir/.gitleaks.toml ) ]]; then + config=.gitleaks.toml +fi +if [[ $scan_dir != "$subject" ]]; then + # Gitleaks resolves extend.path from its working directory, including + # absolute paths and symlinks. Only allow files inside the base tree. + python3 - "$scan_dir" "$config" <<'PY' || exit 2 +import pathlib +import sys +import tomllib + +root = pathlib.Path(sys.argv[1]).resolve() +path = root / sys.argv[2] +try: + for _ in range(3): # Gitleaks follows at most two extensions. + path = path.resolve(strict=True) + if not path.is_relative_to(root) or not path.is_file(): + raise ValueError("config path escapes trusted base") + with path.open("rb") as file: + data = tomllib.load(file) + fields = {key.lower(): value for key, value in data.items()} + extend = fields.get("extend", {}) + extend = {key.lower(): value for key, value in extend.items()} + next_path = extend.get("path", "") + if not next_path: + break + path = root / next_path +except (OSError, ValueError, TypeError, AttributeError) as error: + print(f"untrusted or invalid scanner configuration: {error}", file=sys.stderr) + sys.exit(2) +PY +fi +(cd "$scan_dir" && GITLEAKS_BIN="$scanner" bash "$script_dir/control.sh" "$config") || exit 2 +version=$("$scanner" version) || exit 2 +printf 'scanner=%s mode=%s head=%s history_commits=%s\n' "$version" "$mode" "$head" "$population" +verdict=0 +for pass in tree history; do + started=$SECONDS + args=(--config "$config" --redact=100 --no-banner --exit-code 10 --verbose) + if [[ $pass == tree ]]; then + command=("$scanner" dir "$subject" "${args[@]}") + else + command=("$scanner" git "$subject" --log-opts "$log_opts" "${args[@]}") + fi + rc=0 + (cd "$scan_dir" && timeout --signal=TERM --kill-after=10s "${seconds}s" "${command[@]}") || rc=$? + printf 'pass=%s elapsed_seconds=%s exit=%s\n' "$pass" "$((SECONDS-started))" "$rc" + case $rc in + 0) ;; + 10) [[ $verdict == 2 ]] || verdict=1 ;; + *) verdict=2 ;; + esac +done +printf 'verdict=%s (0=passed, 1=findings, 2=infrastructure/configuration/timeout)\n' "$verdict" +exit "$verdict" diff --git a/actions/secret-scan-check/control.sh b/actions/secret-scan-check/control.sh new file mode 100644 index 0000000..1dfc7bf --- /dev/null +++ b/actions/secret-scan-check/control.sh @@ -0,0 +1,16 @@ +#!/usr/bin/env bash +# SPDX-License-Identifier: MPL-2.0 +# Live positive/negative detector controls with the effective configuration. +# Synthetic, never-issued token is assembled, never stored as a credential. +set -euo pipefail +scanner=${GITLEAKS_BIN:?} +config=${1:-$(cd "$(dirname "$0")/../.." && pwd)/config/gitleaks/estate-baseline.toml} +rc=0 +printf 'A clean control with no credential.\n' | timeout --kill-after=5s 15s "$scanner" stdin \ + --config "$config" --redact=100 --no-banner --exit-code 10 >/dev/null 2>&1 || rc=$? +[[ $rc == 0 ]] || { echo '::error::clean scanner control failed'; exit 2; } +rc=0 +printf '%s_%s\n' ghp Q7mN2aR9vB4cD6eF8gH1jK3pL5sT0uV2wX4z | timeout --kill-after=5s 15s "$scanner" stdin \ + --config "$config" --redact=100 --no-banner --exit-code 10 >/dev/null 2>&1 || rc=$? +[[ $rc == 10 ]] || { echo "::error::planted credential control not detected (exit $rc); no trustworthy scan"; exit 2; } +echo 'real scanner controls passed (clean accepted, synthetic credential refused)' diff --git a/actions/secret-scan-check/install.sh b/actions/secret-scan-check/install.sh new file mode 100644 index 0000000..3f07e2c --- /dev/null +++ b/actions/secret-scan-check/install.sh @@ -0,0 +1,19 @@ +#!/usr/bin/env bash +# SPDX-License-Identifier: MPL-2.0 +# Pinned Linux x64 install; no floating release resolution or cache-as-proof. +set -euo pipefail +[[ $(uname -s) == Linux && $(uname -m) == x86_64 ]] || { echo 'unsupported runner architecture' >&2; exit 2; } +destination=${1:?destination directory required} +mkdir -p "$destination" +tmp=$(mktemp -d) +trap 'rm -rf "$tmp"' EXIT +version=8.30.1 +checksum=551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb +curl --proto '=https' --proto-redir '=https' --fail --silent --show-error --location --connect-timeout 10 --max-time 90 \ + --retry 2 --retry-max-time 180 \ + "https://github.com/gitleaks/gitleaks/releases/download/v${version}/gitleaks_${version}_linux_x64.tar.gz" \ + -o "$tmp/gitleaks.tar.gz" +printf '%s %s\n' "$checksum" "$tmp/gitleaks.tar.gz" | sha256sum -c - +tar -xzf "$tmp/gitleaks.tar.gz" -C "$tmp" gitleaks +install -m 0755 "$tmp/gitleaks" "$destination/gitleaks" +"$destination/gitleaks" version diff --git a/actions/secret-scan-check/test.sh b/actions/secret-scan-check/test.sh new file mode 100644 index 0000000..272796e --- /dev/null +++ b/actions/secret-scan-check/test.sh @@ -0,0 +1,119 @@ +#!/usr/bin/env bash +# SPDX-License-Identifier: MPL-2.0 +# Empirical controls; set GITLEAKS_BIN to run these with the real pinned binary. +set -euo pipefail +root=$(cd "$(dirname "$0")/../.." && pwd) +tmp=$(mktemp -d) +trap 'rm -rf "$tmp"' EXIT +if [[ -z ${GITLEAKS_BIN:-} ]]; then + cat >"$tmp/gitleaks" <<'MOCK' +#!/usr/bin/env bash +set -euo pipefail +[[ ${FAKE_ERROR:-0} != 1 ]] || exit 3 +[[ $1 != version ]] || { echo fixture; exit 0; } +[[ ${FAKE_IGNORE:-0} != 1 ]] || { cat >/dev/null; exit 0; } +if [[ ${REQUIRE_TRUSTED_CONFIG:-0} == 1 ]]; then + [[ -f .gitleaks.toml && -f policy.toml ]] || exit 3 + ! grep -q 'paths =' .gitleaks.toml policy.toml || exit 3 +fi +case $1 in + stdin) content=$(cat) ;; + dir) content=$(find "$2" -type f -not -path '*/.git/*' -not -name '.gitleaks*' -exec cat {} +) ;; + git) source=$2; shift; shift; [[ $1 == --log-opts ]]; content=$(git -C "$source" log --format= -p "$2") ;; + *) exit 3 ;; +esac +if grep -q 'ghp_' <<<"$content"; then exit 10; fi +MOCK + chmod +x "$tmp/gitleaks" + export GITLEAKS_BIN="$tmp/gitleaks" + echo 'Using stand-in scanner: shell/control-flow evidence only.' +else + export GITLEAKS_BIN + echo 'Using real scanner: detection and control-flow evidence.' +fi +export ESTATE_BASELINE="$root/config/gitleaks/estate-baseline.toml" SCAN_TIMEOUT_SECONDS=15 GITHUB_EVENT_NAME=push +fixture() { + local name=$1 + mkdir "$tmp/$name" + git -C "$tmp/$name" init -q + git -C "$tmp/$name" config user.name control + git -C "$tmp/$name" config user.email control@example.invalid + echo clean >"$tmp/$name/readme.txt" + git -C "$tmp/$name" add . + git -C "$tmp/$name" commit -qm clean + export SUBJECT="$tmp/$name" BASE_SHA + BASE_SHA=$(git -C "$SUBJECT" rev-parse HEAD) +} +commit() { git -C "$SUBJECT" add .; git -C "$SUBJECT" commit -qm control; } +expect() { + local expected=$1 label=$2 rc=0 + HEAD_SHA=$(git -C "$SUBJECT" rev-parse HEAD) PR_HEAD=$(git -C "$SUBJECT" rev-parse HEAD) \ + PR_BASE=${PR_BASE:-$BASE_SHA} bash "$root/actions/secret-scan-check/check.sh" >"$tmp/output" 2>&1 || rc=$? + if [[ $rc != "$expected" ]]; then cat "$tmp/output"; echo "FAIL $label: wanted $expected got $rc"; exit 1; fi + echo "ok: $label" +} +fixture clean +SCAN_MODE=full expect 0 'clean full history and tree' +SCAN_MODE=pr-range expect 0 'empty introduced range still scans the tree' +# Build three PR commits. Final tree and BASE..HEAD file diff are clean. +printf '%s_%s\n' ghp Q7mN2aR9vB4cD6eF8gH1jK3pL5sT0uV2wX4z >"$SUBJECT/key.txt" +commit +rm "$SUBJECT/key.txt" +commit +SCAN_MODE=pr-range expect 1 'intermediate committed-then-deleted credential' +SCAN_MODE=full expect 1 'deleted credential remains in full history' +fixture documentation +printf '%s_%s\n' ghp Q7mN2aR9vB4cD6eF8gH1jK3pL5sT0uV2wX4z >"$SUBJECT/guide.adoc" +commit +SCAN_MODE=pr-range expect 1 'AsciiDoc credential detected without a mirror pass' +fixture untracked +printf '%s_%s\n' ghp Q7mN2aR9vB4cD6eF8gH1jK3pL5sT0uV2wX4z >"$SUBJECT/untracked.txt" +SCAN_MODE=pr-range expect 1 'untracked tree credential' +fixture prconfig +cat >"$SUBJECT/.gitleaks.toml" <<'CONFIG' +[extend] +path = "policy.toml" +CONFIG +printf '[extend]\nuseDefault = true\n' >"$SUBJECT/policy.toml" +echo '# trusted ignore' >"$SUBJECT/.gitleaksignore" +commit +BASE_SHA=$(git -C "$SUBJECT" rev-parse HEAD) +printf '%s_%s\n' ghp Q7mN2aR9vB4cD6eF8gH1jK3pL5sT0uV2wX4z >"$SUBJECT/key.txt" +cat >>"$SUBJECT/.gitleaks.toml" <<'CONFIG' +[allowlist] +paths = ['''.*'''] +CONFIG +commit +cat >>"$SUBJECT/policy.toml" <<'CONFIG' +[allowlist] +paths = ['''.*'''] +CONFIG +commit +GITHUB_EVENT_NAME=pull_request REQUIRE_TRUSTED_CONFIG=1 SCAN_MODE=full expect 1 'PR full scan uses base config and extension' +GITHUB_EVENT_NAME=pull_request REQUIRE_TRUSTED_CONFIG=1 SCAN_MODE=pr-range expect 1 'PR range scan uses base config and extension' +echo 'untrusted suppression' >>"$SUBJECT/.gitleaksignore" +GITHUB_EVENT_NAME=pull_request SCAN_MODE=full expect 2 'changed PR ignore file refused' +rm "$SUBJECT/.gitleaksignore" +GITHUB_EVENT_NAME=pull_request SCAN_MODE=full expect 2 'deleted PR ignore file refused' +fixture prignore +echo 'untrusted suppression' >"$SUBJECT/.gitleaksignore" +GITHUB_EVENT_NAME=pull_request SCAN_MODE=full expect 2 'new PR ignore file refused' +fixture prescape +printf '[extend]\npath = "policy.toml"\n' >"$SUBJECT/.gitleaks.toml" +printf '[extend]\nuseDefault = true\n' >"$SUBJECT/external.toml" +ln -s "$SUBJECT/external.toml" "$SUBJECT/policy.toml" +commit +BASE_SHA=$(git -C "$SUBJECT" rev-parse HEAD) +GITHUB_EVENT_NAME=pull_request SCAN_MODE=full expect 2 'config extension escaping trusted base refused' +fixture wrongbase +BASE_SHA=0000000000000000000000000000000000000000 SCAN_MODE=pr-range expect 2 'missing base refuses a verdict' +echo mismatch >"$SUBJECT/.gitleaks-estate.toml" +SCAN_MODE=full expect 2 'conflicting baseline refuses a verdict' +rm "$SUBJECT/.gitleaks-estate.toml" +# A genuinely shallow local clone must not become a one-commit full audit. +git clone -q --depth 1 "file://$SUBJECT" "$tmp/shallow" +SUBJECT="$tmp/shallow" SCAN_MODE=full expect 2 'shallow history refuses a verdict' +if [[ $GITLEAKS_BIN == "$tmp/gitleaks" ]]; then + FAKE_ERROR=1 SCAN_MODE=full expect 2 'scanner infrastructure error is not a pass' + FAKE_IGNORE=1 SCAN_MODE=full expect 2 'vacuous scanner mutant killed by live control' +fi diff --git a/config/gitleaks/estate-baseline.toml b/config/gitleaks/estate-baseline.toml new file mode 100644 index 0000000..e4e0812 --- /dev/null +++ b/config/gitleaks/estate-baseline.toml @@ -0,0 +1,229 @@ +# SPDX-License-Identifier: MPL-2.0 +# Vendored unchanged from metadatastician/standards at +# 1725bebd3773ea25627479f813283abf1c497a85 (config/gitleaks/estate-baseline.toml). +# Historical comments below describe upstream, not suite staging. +# SPDX-License-Identifier: MPL-2.0 +# +# Gitleaks configuration — THE estate baseline. +# +# This file is the single shared allowlist for the whole estate. It is staged +# into a consumer repository's workspace root as `.gitleaks-estate.toml` by +# `.github/workflows/secret-scanner-reusable.yml`, so a repo can write: +# +# [extend] +# path = ".gitleaks-estate.toml" +# [allowlist] +# paths = [ ... entries true for THIS repo only ... ] +# +# and inherit everything here without copying it. See +# docs/GITLEAKS-ESTATE-BASELINE.adoc. +# +# ONLY UNIVERSAL ENTRIES BELONG HERE. An entry added to this file blinds every +# repository in the estate. If a suppression is only correct for one repo, it +# belongs in that repo's own `.gitleaks.toml`, beside the code it describes. +# +# THIS FILE IS LIVE PRODUCTION CONFIG, AND FOR MOST CONSUMERS IT IS UNPINNED. +# The reusable stages this baseline by TWO paths. A consumer that HAS its own +# `.gitleaks.toml` receives the copy fetched at `${{ job.workflow_sha }}` — +# pinned to whichever reusable SHA that consumer pins. A consumer with NO +# `.gitleaks.toml`, which is the large majority, is served by an earlier and +# ungated step that fetches from this repository's DEFAULT BRANCH. For those +# repositories an edit here takes effect on their very next run, with no pin +# standing between them and it. +# +# Two things follow. Edit this file as you would edit something already in +# production — a broadened pattern blinds 400+ repositories the same day. And +# a deliberate change arrives UNEVENLY: instantly for no-config consumers, and +# only at pin-bump speed for the rest. Stage behaviour changes accordingly. +# +# WHY THIS FILE EXISTS +# -------------------- +# Until #500 the estate's gitleaks step carried `continue-on-error: true`, so +# the primary secret scanner could not fail a PR. #500 made it gate for real +# (`gitleaks detect --exit-code 1` against a checksum-verified binary). The +# first honest run then surfaced 15 findings in this repo — every one a false +# positive: module integrity hashes, package UUIDs, a public GPG fingerprint, +# a Haskell type *name*, and synthetic `.example` fixtures. +# +# That is very likely the trap the `continue-on-error` was papering over: turn +# the gate on with no allowlist, get a wall of red that is entirely noise, +# someone reverts, and the estate is back to a scanner that cannot fail. This +# config is therefore the *unblocker* for re-pinning callers onto the real +# gate across the estate. +# +# DESIGN RULE — KEEP THIS WHEN EDITING +# ------------------------------------ +# Allowlist by PATTERN CLASS, anchored to the WHOLE value. Never allowlist a +# path wholesale because "that file is fine", and never disable a rule. +# +# Every `regexes` entry below is anchored `^...$` on purpose. An unanchored +# entry is a substring match, which silently blinds the scanner: a pattern +# like `(?i)test|example` would allowlist the real AWS key +# `wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY` purely because "EXAMPLE" appears +# inside it. That was caught by canary-testing an earlier draft of this file — +# if you add a pattern here, plant a realistic secret and confirm it is still +# detected before you commit. +# +# `paths` entries are limited to formats that cannot legitimately hold a live +# credential (lockfile integrity hashes, dependency UUIDs). If you want to +# allowlist any other path wholesale, that is a signal the secret should be +# removed from the tree instead. + +[extend] +useDefault = true + +[allowlist] +description = "Estate baseline: dependency metadata, anchored placeholder shapes, published test vectors" + +# HOW THE `regexes` SECTION BELOW ACTUALLY BEHAVES — MEASURED. READ BEFORE EDITING. +# +# An earlier revision of this comment claimed that gitleaks matches these +# allowlist regexes against a finding's MATCH rather than its SECRET, and +# concluded that an anchored `^value$` entry is silently INERT for +# `generic-api-key`. THAT CLAIM IS FALSE, and every entry below depends on it +# being false — none of them sets `regexTarget`, and all eight are anchored on +# the value. Re-measured 2026-09-04 on the CI-pinned gitleaks 8.18.4, with the +# config and the JSON report both kept OUTSIDE the scanned tree: +# +# fixture Key : Ed25519_Private_Key; +# MATCH = `Key : Ed25519_Private_Key;` SECRET = `Ed25519_Private_Key` +# +# allowlist entry under test findings (control, no entry = 1) +# ^SECRET$, regexTarget unset 0 SUPPRESSED +# ^SECRET$, regexTarget = "secret" 0 SUPPRESSED +# ^SECRET$, regexTarget = "match" 1 not suppressed +# ^MATCH$, regexTarget = "match" 0 SUPPRESSED +# +# `regexTarget` DEFAULTS TO THE SECRET. An anchored value regex is the normal, +# working way to exempt a `generic-api-key` false positive and needs no +# `regexTarget` at all. Field evidence agrees: one anchored value regex took +# metadatastician/cerro-torre from 19 findings to 12. +# +# ANCHOR ON THE SECRET AS THE TOOL EXTRACTS IT, NOT ON THE STRING YOU SEE. A +# specific rule outranks `generic-api-key` and may extract a NARROWER secret +# than the quoted value. Measured on the same fixture: `tok = "AKIA…EXAMPLE..."` +# is reported by `aws-access-token` with the trailing `...` NOT part of the +# secret, so the placeholder regex below — which requires it — does not fire; +# `sk_test_…` is reported by `stripe-access-token`, not by the `_test_` rule. +# Read the finding's `Secret` field (`--report-format json`) and anchor on +# that. Guessing from the source line is how a correct-looking entry misses. +# +# WHY THE FALSE CLAIM WAS BELIEVABLE — THE INSTRUMENT TRAP. If the gitleaks +# config or the JSON report lives INSIDE `--source`, gitleaks scans them too; +# their own credential-shaped content trips `generic-api-key`, the count never +# reaches zero, and a WORKING allowlist entry reads as inert. That is the most +# likely way the original measurement went wrong — it is easy to hit, silent, +# and it produces exactly the observation the old comment recorded. Reproduce +# correctly with `scripts/verify-regextarget-claim.sh`, which aborts unless the +# control shows exactly one finding. +# +# CONSEQUENCE FOR EDITORS — PREFER A VALUE ENTRY OVER A PATH ENTRY. A `regexes` +# entry suppresses exactly one string, so a credential planted in the same file +# is STILL caught. A `paths` entry blinds the whole file to everything. Reach +# for a path entry only where the value's SHAPE genuinely is a credential's — +# 64 lowercase hex, say, which is byte-for-byte a hex-encoded Ed25519 private +# key, so exempting the class would blind every such key in the tree. (Scoping +# a regex to a path — `[[allowlists]]` with `condition = "AND"` — would answer +# that case, but is SILENTLY IGNORED at 8.18.4; it arrives at 8.19+.) +# +# The character classes below are deliberately narrow, and that is not an +# oversight to be widened. `[A-Za-z]*` has no `_`, so the CamelCase crypto-type +# entry does NOT match Ada snake_case names such as `Ed25519_Private_Key`; +# those belong in the owning repository's own `.gitleaks.toml`, beside the code. + +paths = [ + # This file, at its canonical path and under the name it is staged as in a + # consumer workspace. While it lived at a repo root as `.gitleaks.toml` + # gitleaks excluded it automatically as its own config; at any other path it + # is an ordinary file, and its documented placeholder shapes trip + # generic-api-key. Measured by scanning before and after the move. + '''(^|/)\.gitleaks-estate\.toml$''', + '''(^|/)config/gitleaks/estate-baseline\.toml$''', + # The estate baseline ITSELF, staged into the workspace root by + # secret-scanner-reusable.yml so that a repo-local `.gitleaks.toml` can + # `[extend] path = ".gitleaks-estate.toml"` and inherit everything here. + # + # Without this entry the file detonates on itself: its anchored example + # regexes (RFC 8032 vectors, masked-token shapes) are credential-SHAPED by + # construction, so `generic-api-key` fires on the config and EVERY repo using + # it goes red. Measured, not theoretical — same failure class as the + # self-detonating template block that tripped the mint e2e guard. + '''(^|/)\.gitleaks-estate\.toml$''', + + # Vendored package-manager bundles. Yarn's "zero-install" workflow commits a + # published, checksum-pinned release binary; the high-entropy runs inside it + # are minified third-party code, not estate source, and cannot be edited + # meaningfully. Same category as a lockfile. + '''(^|/)\.yarn/releases/''', + # Lockfiles: the "secrets" are SHA-256 *integrity hashes* of public registry + # modules. A lockfile has no legitimate reason to contain a credential. + '''(^|/)deno\.lock$''', + '''(^|/)package-lock\.json$''', + '''(^|/)yarn\.lock$''', + '''(^|/)Cargo\.lock$''', + # Julia project manifests: entries are public package UUIDs from the General + # registry, which trip the generic-api-key entropy heuristic. + '''(^|/)Project\.toml$''', + '''(^|/)Manifest\.toml$''', +] + +regexes = [ + # --- documented placeholder shapes (all anchored to the whole value) ------ + + # Ellipsis-terminated illustrative values: `abc123def456...` (carrying an + # explicit "// Would be real token" comment), `1234567890_abc123...` inside a + # fenced ASCII mockup of terminal output. A real credential is never elided. + '''^[A-Za-z0-9_\-]{4,}\.\.\.$''', + + # Repeated-character masks: a provider prefix followed by a long run of a + # single filler character (the GitLab, GitHub and OpenAI token prefixes are + # all commonly masked this way in docs). A real credential never repeats one + # character 8+ times. + # + # Deliberately described rather than shown: writing the masked token out + # literally here makes THIS file trip the estate's Hypatia secret detector + # ("Secret found: GitLab PAT"), which is how that was found. Do not add + # literal example tokens to this file, even inside comments. + '''^[A-Za-z0-9_\-]*?(x{8,}|X{8,}|y{8,}|z{8,}|0{12,}|\*{6,})[A-Za-z0-9_\-]*$''', + + # Monotonic hex walks used as filler: `0123456789abcdef` repeated, + # `ABCDEF0123456789ABCDEF0123456789`, `0a1b2c3d4e5f6a7b…` (ascending nibble + # pairs). These are keyboard-walk fillers, never generated key material. + '''^(?i:0123456789abcdef|abcdef0123456789|0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1|deadbeef|cafebabe)+$''', + + # Snake-case self-labelled fixtures, e.g. `sg_test_api_key_abc123`. Anchored + # and shape-constrained: an all-lowercase snake_case string with an explicit + # test/demo marker as a bounded segment. Real API keys carry mixed case, + # digits and symbols and will not match this. + '''^[a-z]{2,6}_(test|demo|fake|sample|example|dummy|placeholder)_[a-z0-9_]{2,40}$''', + + # --- published test vectors ---------------------------------------------- + # RFC 8032 §7.1 TEST 1 Ed25519 seed and the public key it derives. These + # exact values are printed in the RFC; checking that one yields the other is + # the entire point of the interoperability test. + '''^9d61b19deffd5a60ba844af492ec2cc44449c5697b326919703bac031cae7f60$''', + '''^d75a980182b10ab7d54bfed3c964073a0ee172f3daa62325af021a68f707511a$''', + + # --- public-by-definition / non-secret identifiers ------------------------ + # OpenPGP 40-hex fingerprints. A fingerprint *identifies* a key; it is + # published deliberately (3-practice/SECURITY.md, audit records, keyservers) and + # discloses nothing. Secret key *material* is PEM-armoured and is caught by + # the dedicated private-key rules, which are NOT allowlisted here. + '''^[A-F0-9]{40}$''', + + # Cryptographic *type names* appearing in source/design docs, e.g. the + # Haskell declaration `data Ed25519KeyPair = Ed25519KeyPair`. A bare + # CamelCase identifier with no digits or separators is a type, not a key. + '''^(Ed25519|X25519|Curve25519|RSA|ECDSA|EdDSA|Secp256k1)[A-Za-z]*$''', + + # --- document references ------------------------------------------------- + # A single documentation FILENAME captured as a record's value. Shape (kept + # described, not shown, per the rule at the top of this list): a prose record + # whose KEY contains an `auth`-like keyword (e.g. an "authoritative text" + # field) and whose quoted VALUE starts with a doc filename, so + # `generic-api-key` captures the filename as the secret. Found in a + # machine-readable STATE record, echo-types#329 (PR #331), 2026-09-30. + # True for every repository: no credential format ends in `.adoc` or `.md`, + # and the class admits no `/`, so it names one file, never a path or a blob. + '''^[A-Za-z0-9][A-Za-z0-9._-]*\.(adoc|md)$''', +] diff --git a/docs/CI-TRIAGE-2026-10-30.adoc b/docs/CI-TRIAGE-2026-10-30.adoc new file mode 100644 index 0000000..b1481c4 --- /dev/null +++ b/docs/CI-TRIAGE-2026-10-30.adoc @@ -0,0 +1,161 @@ +// SPDX-License-Identifier: CC-BY-SA-4.0 += Estate CI triage — 2026-10-30 + +== Scope and limits + +Read-only sample of 60 open PRs returned by `gh search prs --owner +hyperpolymath --state open --limit 60`, followed by PR state/check queries. +This is not the notifications inbox or a complete estate census. The +notifications endpoint returned 403. No cross-repository edits, merges, +reruns, ruleset changes or permission changes were made. + +Sample: 45 BLOCKED, 5 UNSTABLE, 10 CLEAN. A failed check count is not the +number of required merge blockers; requirements need separate rule and +classic-protection evidence. Rollup absence is not evidence of a clean scan. +Some rollups can also be truncated by GitHub. + +== Merge-ready candidates to recheck before approval + +https://github.com/hyperpolymath/boj-server/pulls[boj-server] PRs #369 through +#378 all reported CLEAN and MERGEABLE, each with 45 rollup entries, consisting +of SUCCESS and SKIPPED results. This is GitHub's observed readiness, not a +claim that all 45 checks executed. No PR was merged. Revalidate head SHA, +required checks and policy immediately before merging each; merging one may +invalidate readiness of another. + +== Repeated failure families + +[cols="1,1,3",options="header"] +|=== +|Rollup name |Occurrences in sample |Evidence / action +|Validate K9 contracts |15 |idrisiser#93 annotations identify +`container/deploy.k9.ncl`: missing K9! and pedigree name. Determine whether it +is a K9 contract or an ordinary Nickel deployment module before adding fields. +|Validate DEED manifests |13 |idrisiser#93: ordinary-looking +`docs/governance/MAINTENANCE-CHECKLIST.a2ml` rejected for missing manifest +identity. A filename suffix alone is not evidence that a document is a manifest. +|Hypatia neurosymbolic scan |15 |idrisiser scanner setup and execution succeeded; +the final critical-findings step failed. Six retired-location descriptile +findings are accompanied by Zig cast, download/execute and optional-secret +annotations. The aggregate calls six findings critical security issues; audit +the actual severity/rule mapping before calling this either all noise or all +exploitable vulnerabilities. +|lint-workflows |10 |Includes duplicate push/PR runs. vocarium#47's inspected +failure is the Check SPDX Headers step, not an Actions YAML parse error. +|Dependency audit |3 |echidnabot PRs; dependency repair belongs to that repository. +|Rust Dependency Audit |2 |hypatia#983 annotation reports one vulnerable advisory; +exact advisory unavailable from annotations. Keep enforcement, obtain redacted +findings and repair/justify dependencies. +|Rust License & Ban Check |2 |hypatia#983 fails at Check licenses and bans after +successful installation; exact policy finding requires log/artifact evidence. +|governance / Allowlist Preflight |2 |hypatia tree-allowlist step fails; do not +confuse this with GitHub's Actions admission policy. +|=== + +Additional inspected examples: + +* https://github.com/hyperpolymath/boinc-boinc/actions/runs/41036353652[boinc-boinc#85] + still uses a sequential estate-audit copy: code-hygiene fails, then the + manifest and subsequent gates are skipped. The suite already has separate + component jobs and continuation within components. Migrate to a reviewed, + SHA-pinned reusable rather than proliferating another copy. Triage actual + debt/circumventions before adding narrow trusted-base exemptions. +* https://github.com/hyperpolymath/preference-injector/actions/runs/41128726229[preference-injector#109] + fails Deno lint. Its test/coverage failures need their own diagnosis; don't + replace language-specific CI with a generic governance audit. +* `unified-dataset-vocab#80` has no red checks in the rollup but a required + `scan / gitleaks` context and an immediately failed zero-job scanner workflow. + See link:SECRET-SCAN-PERFORMANCE.adoc[secret-scan investigation]. + +Raw log downloads were blocked by the environment's outbound host policy. +REST job steps and check annotations supplied the findings above. No exact +cargo-deny, Deno lint, or workflow-startup root cause is invented here. + +== What to reuse; what not to swap in blindly + +* Keep the suite's componentised audit, tool-absence exit-2 contract, + negative controls, planted prover controls, caller SHA verification and + transitive-lock guards. These address actual previously observed failures. +* Prefer repo-specific compiler/test/prover commands over filename existence + checks. Governance, linting, security and functional correctness are + complementary, not substitutes. +* The suite's manifest wrapper already supports distinct narrow DEED/K9 + exclusions. First fix validator subject selection or document classification; + an estate-wide suffix exemption would hide real malformed manifests. +* `semantic-audit` and PRAT remain out of the enforcing workflow. Squabbler + now exists but is not the imagined semantic audit command. Corrected the + obsolete README assertion; no stub was promoted to assurance. +* The proposed fast secret-scan execution model must be implemented and + measured upstream before switching consumers. No replacement was deployed. + +== Guidance consulted (source snapshots) + +* `metadatastician/standards@1725bebd3773ea25627479f813283abf1c497a85`: + `.github/ISSUES/2026-06-05-cicd-optimization-roadmap.md`, issue 004, + shared secret-scanner source. Adopt deduplication and explicit scope, not + unsafe illustrative path filters: required workflow-level filters can + strand checks, and changed_files is a count, not a list of filenames. +* `hyperpolymath/proven-tests-and-benches@d986d4cbdc6aae8f1585a9262b0b5ceeb8532183`: + evidence-bearing classifications, executed coverage and cost-aware routing. + Bash example fixtures added here are *Unproven* in that framework, not + Actually-Proven because a document mentions a proof. There is no live + Idris2 bridge implemented in this change. +* `hyperpolymath/cicd-squabbler@193349090edb29f4ed1ef82142c207e22e1715c9`: + zero-job/chains/fight diagnosis, rulesets plus classic protection, refusal + to bypass, and explicit unattributed outcomes. The collector complements + this engine; it does not replace it. +* `hyperpolymath/reposystem@46eac54730e1b0ec30ad14aef37baef6bc41645f`: + graph/scenario/plan-with-rollback approach. Assumed this was the user's + intended repository; `hyperpolymath/repos` returned 404. Confirm that name + before treating this as the complete requested repository guidance. + +== Handoff: Hypatia owner + +---- +Investigate idrisiser#93, job 124299507009, and the same repeated failure +family in julianiser, oblibeniser, eclexiaiser, betlangiser, lustreiser, +ponyiser, otpiser, phronesiser, nimiser, wokelangiser and iseriser. +Separate governance migration findings from exploitable security findings and +scanner non-execution. Inspect the actual severity mapping: six retired 6a2 +locations are reported alongside an aggregate "6 critical security issues". +Do not simply downgrade everything or suppress Zig casts globally. Add +positive/negative controls for valid FFI casts versus unsafe uses, document +paths, download-integrity failures, and optional missing dispatch tokens. +Emit rule ID, class, severity, confidence, applicability and redacted location. +Keep genuine security defects blocking. Propose severity changes for review. +---- + +== Handoff: DEED/K9 validators and consumer repositories + +---- +Use idrisiser#93 jobs 124299507166 and 124299506965 as reproduction evidence. +Classify docs/governance/MAINTENANCE-CHECKLIST.a2ml and container/deploy.k9.ncl +by intended format. Implement explicit subject selection if ordinary documents +or Nickel modules are mistaken for manifests. If they are actual manifests, +fix their missing identity/K9!/pedigree fields instead. Add controls for valid +non-manifest documents/modules, malformed real manifests, and path-scoped +exclusions that do not hide neighbouring defects. Keep DEED/K9 exclusions +separate; test through the cicd-suite composite and update pins only after a +consumer canary passes. No blanket extension/path allowlist. +---- + +== Handoff: proven-tests-and-benches / reposystem / fleet + +---- +Define a versioned gate-evidence interchange with cicd-suite and squabbler: +subject SHA, trusted base, detector/config digest, applicability, population, +executed result, tool/infrastructure errors, negative-control result, evidence +URL and elapsed/queue times. Derive coverage from execution, not declarations. +Keep empirical fixtures Unproven until a real typed proof/bridge warrants a +higher tier. Resolve the 16-category standard vs 17-category local extension +explicitly rather than silently promising full taxonomy coverage. + +Use reposystem to record caller -> reusable -> composite -> config/lock +edges, canonical coordinates and immutable pins. Simulate and canary changes +upstream-first with rollback, deduplicate overlapping checks by demonstrated +coverage, and retain repo-specific builds/tests. Fleet should propose consumer +migration PRs, not directly rewrite policies or auto-admin-merge. Observe the +current head's required checks before announcing readiness. Notification +monitoring/webhook deployment is separate work; this session has not installed +an ongoing watcher. +---- diff --git a/docs/SECRET-SCAN-PERFORMANCE.adoc b/docs/SECRET-SCAN-PERFORMANCE.adoc new file mode 100644 index 0000000..cd2406f --- /dev/null +++ b/docs/SECRET-SCAN-PERFORMANCE.adoc @@ -0,0 +1,175 @@ +// SPDX-License-Identifier: CC-BY-SA-4.0 += Secret scanning: fix the wait, not the security floor +:toc: + +== Observed on 2026-10-30 + +The user's hours/days report must not be interpreted as measured scanner CPU +time. There are at least four clocks: event-to-start, runner queue, setup, +and execution. A missing required context has no completion clock at all. + +* https://github.com/hyperpolymath/unified-dataset-vocab/pull/80[unified-dataset-vocab#80] + reports BLOCKED despite no failing checks in the sampled PR rollup. + Its head is `e094c69715e999d1454b057f35202da65bc6bd1e`. +* https://github.com/hyperpolymath/unified-dataset-vocab/actions/runs/41132257808[Secret-scanner run 41132257808] + was created and completed at `2026-10-30T21:36:06Z`, conclusion failure, + *zero jobs*. No Gitleaks execution occurred in this run. +* The effective rules require `scan / gitleaks`, integration ID 15368. + An immediately rejected workflow cannot emit that job check. Waiting for it + or admin-merging does not establish that the secrets check passed. +* The Hypatia and governance workflows on that head also failed with zero + jobs (41132257847 and 41132257825). +* https://github.com/hyperpolymath/cicd-suite/actions/runs/40970192107[cicd-suite's secret-scanner run 40970192107] + also has zero jobs. Its suite has zero check runs. +* `hyperpolymath/standards` resolves through REST to + `metadatastician/standards`. cicd-suite's caller still names the former at + `74d2f66f575246cf6e313ae7775f44df6e097ff2`; the target workflow file exists + at that SHA under the canonical repository. This is evidence of a moved + dependency, *not proof of why GitHub rejected the run*. Admission, nested + permissions, locks, and workflow validity still need examination at the + actual pinned commit, not just upstream HEAD. + +Notifications API and Actions policy reads returned 403; classic branch +protection also returned 403 in the live collector trial. Raw Actions log +retrieval redirects to an unavailable host in this environment; check +annotations and step metadata were used instead. No exact startup diagnostic +was obtained. Do not label these cases a proven allow-list rejection or a +proven move-induced failure without that diagnostic. + +== A second, independent cost problem + +The shared scanner inspected at standards commit +`1725bebd3773ea25627479f813283abf1c497a85`: + +* sets the Gitleaks job timeout to 20 minutes; +* fetches full Git history with `fetch-depth: 0`; +* installs a checksum-verified Gitleaks 8.18.4 binary; +* scans both working tree and full history on each PR; +* stages an estate baseline from the reusable's own SHA and removes tooling + checkouts before scanning. + +This is a source inspection, not a timing benchmark of the caller's older +pinned revision. Repeated full-history scans can waste substantial minutes, +but that loop does not explain a zero-job run or days of waiting by itself. +Timeouts start when a job executes, not when a required context is expected. + +== Proposed replacement execution model + +Keep one recognisable required PR context: `scan / gitleaks`. Do not rename +it, remove it from rules, pass it with an echo, or mark failures nonblocking. +Separate fast prevention from historical discovery: + +[cols="1,3",options="header"] +|=== +|Lane |Contract +|PR prevention |Scan every introduced commit in the trusted base-to-head range, +including intermediate commits containing a secret subsequently deleted. Also +scan the intended checked-out content. No workflow-level path filters on the +required caller. A detector/configuration change triggers the broader audit +policy, not silent reuse of an older result. +|History audit |Full reachable history on initial onboarding, scheduled runs, +scanner/rule/baseline changes and explicit dispatch. Unresolved findings remain +tracked and escalated; scheduling them is not acceptance of known leaks. +|=== + +Do not use only `git diff BASE HEAD`: it misses a secret added and removed +inside the PR. Do not assume a depth-one checkout contains the complete PR +range. Resolve the trusted base and head to verified SHAs and explicitly +fetch the ancestry needed to scan *every commit in that range*. Missing +objects, an ambiguous merge base, an unrelated history or an unavailable base +must produce an explicit bounded fallback or an infrastructure failure, +never success. Measure the fetch as well as the scan. + +Before moving an existing full-history security guarantee out of the PR +lane, get security-owner approval of the new coverage boundary. Require an +initial completed full audit; define what unresolved historical findings do +to readiness. If the policy requires all history at merge time, retain it +until an equivalently trustworthy incremental-history design is accepted. + +== Operational budgets and measurement + +Proposed initial service objectives, *not measurements achieved here*: + +* Normal PR end-to-end p95 under 5 minutes; Gitleaks execution p95 under + 2 minutes on a declared representative corpus. +* PR job deadline 10 minutes; network connect and total download deadlines, + bounded retries, scanner wall-clock deadline, plus runner cleanup margin. +* Separately record event, queue, checkout, install, config, tree scan and + commit-range scan times; record commit/byte/file populations, scanner + version, config digest, base/head SHAs and result. Never export secret + values or unredacted scanner output. +* Alert within 5 minutes on a required context that has no corresponding + running/queued job and an observed failed workflow; distinguish it from + runner starvation, approval waits, superseded runs and a running timeout. +* Cancel superseded runs for the same PR; re-run the current head, not an old + SHA. Keep PR cancellation groups separate from scheduled history audits. +* Avoid duplicate scanners doing identical work. Retain specialised shell + rules only if planted controls show unique coverage beyond Gitleaks. + +A cache can accelerate a verified binary download. A cache hit must never +stand in for a scan. An incremental clean-history watermark is security +state: key by repository, verified ancestry, scanner/config/baseline digests +and audited SHA, and protect it against PR-controlled writes. Do not add one +until invalidation, fork trust and tampering controls are tested. + +== GitGuardian comparison + +GitGuardian may be an effective replacement, but similar names do not imply +identical scan populations, detectors or trust boundaries. No GitGuardian +runtime or coverage was measured here. Compare it and Gitleaks on the *same* +corpus and planted leaks, with identical history boundaries, before claiming +one is faster at equivalent detection. Assess fork behaviour, availability, +licensing, data handling, custom estate rules, and the exact check integration +identity required by the ruleset. Do not run both permanently on every PR +without evidence that each finds something important the other misses. + +== Copyable handoff: standards owner + +---- +Investigate and repair secret-scanner-reusable.yml in metadatastician/standards. +Consumers include hyperpolymath/cicd-suite and unified-dataset-vocab. Preserve +scan / gitleaks and real enforcement; do not admin-bypass or widen tokens. + +First reproduce zero-job failures 40970192107 (cicd-suite) and 41132257808 +(unified-dataset-vocab). Read the actual workflow validation error, caller +Actions policy, callee/transitive lock and minimum permissions at each pinned +SHA. Verify the moved hyperpolymath/standards coordinate vs canonical owner. +Propose canonical-coordinate and minimal admission changes separately from +version repinning; do not assume a REST redirect proves Actions resolution. + +Then design a bounded fast PR lane scanning the working tree and all commits +introduced by the PR, retaining committed-then-deleted leak detection. Keep a +separate complete-history lane for onboarding, schedule, scanner/config changes +and dispatch. Obtain security-owner approval of this coverage split. Preserve +checksum-pinned installation and SHA-matched baseline staging. Add bounded +network retries/timeouts, queue/setup/scan telemetry and redacted artifacts. + +Acceptance controls: planted live-shaped test credentials (synthetic only), +secret added then deleted in an intermediate PR commit, clean PR, justified +fixture exception, new real leak beside an exception, shallow/missing history, +force push, fork PR, merge queue, configuration/rule changes, denied download, +nonzero scanner exit, timeout, tampered cache, zero-job rejection, and empty +scan population. Each defect must fail for the intended reason. Report actual +p50/p95 timings and populations on small/medium/large consumer repositories. +Canary a pinned caller; observe a real scan / gitleaks result before estate +rollout. Keep the previous pin for rollback. No assurance from absent checks. +---- + +== Copyable handoff: cicd-squabbler and gitbot-fleet + +---- +Diagnose missing scan / gitleaks contexts using both check surfaces and workflow +runs, including completed failed runs with zero jobs. Do not call this a slow +Gitleaks scan unless a Gitleaks job actually started. Distinguish absent job, +queued runner, approval wait, setup failure, running scanner and timed-out scan. +Attribute moved coordinate / Actions admission / permissions / lock failure +only from supporting evidence; otherwise Unattributed with probe failures. + +Retain squabble != bypass. No required-context deletion, fake green, permissive +continue-on-error, admin merge or broad permissions. Propose canonical-coordinate +repairs and minimal admission requests; run canaries and observe the required +context before rollout. Deduplicate notifications by repo/head/workflow/cause, +reopen on changed head or policy, and notify the owner when the current head is +legitimately merge-ready. The new cicd-suite inspect-pr-ci.sh is a read-only +head-SHA evidence bundle, not a replacement for squabbler or a merge verifier. +---- diff --git a/docs/SECRET-SCANNER-ROLLOUT.adoc b/docs/SECRET-SCANNER-ROLLOUT.adoc new file mode 100644 index 0000000..8023344 --- /dev/null +++ b/docs/SECRET-SCANNER-ROLLOUT.adoc @@ -0,0 +1,96 @@ +// SPDX-License-Identifier: CC-BY-SA-4.0 += Bounded scanner implementation and staged rollout + +== Current boundary + +The suite now carries an implementation, not only a specification: + +* `actions/secret-scan-check/{install,control,check,test}.sh`, composite action; +* `.github/workflows/secret-scanner-reusable.yml`; +* `templates/secret-scanner-caller.yml`; +* `.github/workflows/secret-scanner-self-test.yml` for real-binary controls. + +No estate deployment or performance success is implied by file creation. +Full history is the default. PR-range mode requires an explicit opt-in; +non-PR runs always scan full history. Local tests use a stand-in only when +GITLEAKS_BIN is unset and explicitly announce that limitation. The same +fixtures must pass against the pinned real detector on GitHub runners. + +The baseline is vendored from standards at +1725bebd3773ea25627479f813283abf1c497a85 with attribution. Its existing +exceptions are not newly validated by this import. Repo-local config remains +supported and must pass the synthetic detector controls. The original +specialised Rust/shell heuristic jobs are not included; do not retire them +on the strength of generic Gitleaks controls alone. + +== Inventory + +On 2026-10-30, `gh repo list hyperpolymath --limit 1000` returned 360 +repositories, all public and non-archived, matching the user's public repo +count returned by REST. metadatastician has another 43 public repositories; +confirm intended ownership scope before any rollout there. This is a repo +inventory, not evidence that every workflow has been inspected or changed. + +== Ordered rollout + +. Publish the implementation on the fixed Arena branch; run real-detector CI. +. Add a SHA-pinned caller canary in cicd-suite while retaining the old scanner + as a visibly separate legacy check. Do not have two workflows emit the same + required context; the new caller must own `scan / gitleaks` unambiguously. +. Confirm caller resolution, actual startup, planted controls, tree/history + scans, fork behaviour and current-head check context. Resolve any historical + leaks, policy rejection or timeout rather than suppressing it. +. Compare old Rust/shell-specific detection with the new scanner. Preserve + unique rules, test intentional suppressions, and obtain security-owner + approval for any coverage changes. +. Propose consumer migration PRs in small batches, keeping each consumer's + default branch, triggers, local exceptions, locks and supplementary checks. + Use one reviewed full SHA and an owner/repo admission pattern only if policy + evidence requires it. No organisation-wide policy weakening. +. Increase batch size only after real canaries pass. Report failures by + repository/head/cause and stop the batch on a shared regression. Preserve + old caller content/pins for rollback. Recheck required-context identity and + missing-job runs separately from the visible check rollup. + +== Assistance that may be needed + +The integration cannot currently read Actions admission settings or some +classic-protection settings (403). An owner may need to inspect the precise +startup validation error and approve a minimal admission change. No token, +password or secret needs to be supplied in chat. Human approval is also +needed before retiring unique scanner coverage or accepting a new history +coverage boundary. Neither is solved by admin-merging. + +== Observed live canary (2026-10-30) + +https://github.com/hyperpolymath/cicd-suite/pull/62[Draft PR #62] publishes +this work without merging it. Implementation commit +025b5dee724a915d6ed1960095b5872fa3b77486 was exercised by: + +* https://github.com/hyperpolymath/cicd-suite/actions/runs/41138675983[Real-binary control run]: + passed; job duration 19 seconds, including installation and both stand-in + and real-detector fixtures. +* https://github.com/hyperpolymath/cicd-suite/actions/runs/41138737134[Actual caller canary]: + `scan / gitleaks` passed; job duration 10 seconds. The main scan step ran + 22:32:11–22:32:13 UTC, after live controls and installation. Both full + history and working tree were requested; this was not fast-pr mode. +* GitGuardian passed on the same PR in an 11-second reported check duration. + This single small repository is not a cross-estate performance benchmark. + +The retained legacy workflow still fails before jobs start. The new caller +therefore demonstrates restoration of a real required scanner check, not +repair of the legacy upstream. Do not mark that separate failure resolved. + +The standard-path inventory in +link:secret-scanner-rollout-inventory.json[secret-scanner-rollout-inventory.json] +records all 360 hyperpolymath repos: 338 reusable-call review candidates, +14 custom scanners, 8 absent at the standard path. It stores coordinates, +blob IDs and classification only, not scanner contents or secret values. +Absence at that path is not absence of all scanning. No consumer repository +has been changed by this inventory; the only edited caller is cicd-suite's +unmerged canary. Protect custom triggers and supplementary jobs during review. + +SonarCloud initially rejected the PR for an HTTPS-redirection concern in the +installer. Added explicit HTTPS-only initial and redirect protocols; other +annotations about positional arguments were also addressed. A new analysis +must validate the correction; the quality gate has not been weakened. diff --git a/docs/secret-scanner-rollout-inventory.json b/docs/secret-scanner-rollout-inventory.json new file mode 100644 index 0000000..45abbb2 --- /dev/null +++ b/docs/secret-scanner-rollout-inventory.json @@ -0,0 +1,4256 @@ +{ + "observed_date": "2026-10-30", + "scope": "hyperpolymath public repositories returned by gh repo list (360); standard-path read only, not complete workflow discovery", + "deployed_to_consumers": false, + "counts": { + "review_candidate": 338, + "custom_scanner_review": 14, + "not_at_standard_path": 8 + }, + "repositories": [ + { + "repository": "hyperpolymath/absolute-zero", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "ff7a4aeba62c7b5552b79569103f4e548cb6dd3a", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@94572e612a7bf11f8e6343d19adadf17ef2a3de3" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/unified-dataset-vocab", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "5f305c596389e2212f14ebd7069db631b5e42c5a", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@c65436ee3351cd6b0fa14b142938b195efc77586" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/universal-language-server-plugin", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "1368354e64bd4357f9dda39f4fc3647d6b358bd9", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@8f2ee50841e216cd8c192eeb68953118190f105c" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/hypatia", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "7ad62ab46de182c5e5e68e67f70457fd1daef0da", + "reusables": [ + "metadatastician/standards/.github/workflows/secret-scanner-reusable.yml@333b06a01db1874ffedb2de1bfabb195640927c7" + ], + "fast_pr_opt_in": false, + "has_inherit": false + }, + { + "repository": "hyperpolymath/preference-injector", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "99e419a1cb53361d57aea282588d03467402d1aa", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@c65436ee3351cd6b0fa14b142938b195efc77586" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/presswerk", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "14187a6bc0d0eb6d29954de21e7b606dd3d9d448", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/halideiser", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "a6a596cad55778783d886a9825240d6f98d11720", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/MetaManifold-WebUI", + "default_branch": "main", + "archived": false, + "state": "custom_scanner_review", + "blob_sha": "ce0c5aa7248fe9effbc86b0b406fb4a16dd79031", + "reusables": [], + "fast_pr_opt_in": false, + "has_inherit": false + }, + { + "repository": "hyperpolymath/idrisiser", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "a6a596cad55778783d886a9825240d6f98d11720", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/julianiser", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "87dba59b6441fe8c9bb9313b201e95f3647e9669", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@c65436ee3351cd6b0fa14b142938b195efc77586" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/vocarium", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "39883a4e9b3eb5b37b477d9107a66afdb303167d", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/oblibeniser", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "87dba59b6441fe8c9bb9313b201e95f3647e9669", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@c65436ee3351cd6b0fa14b142938b195efc77586" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/eclexiaiser", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "87dba59b6441fe8c9bb9313b201e95f3647e9669", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@c65436ee3351cd6b0fa14b142938b195efc77586" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/ubicity", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "7c40c710fc5d3965d44d6fd47e28f1599d2cc5eb", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/bunsenite", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "fffde78cd00090b9a6b995797902dde55971010e", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/kaldor-iiot", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "3cd9ae564d91cf8f6530b50d5803ce3fdbc37983", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/betlangiser", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "87dba59b6441fe8c9bb9313b201e95f3647e9669", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@c65436ee3351cd6b0fa14b142938b195efc77586" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/hfgtfoomw", + "default_branch": "main", + "archived": false, + "state": "custom_scanner_review", + "blob_sha": "eaea280d85a7af87884b3dd093eaa2d2cf33fd46", + "reusables": [], + "fast_pr_opt_in": false, + "has_inherit": false + }, + { + "repository": "hyperpolymath/rescript-ecosystem", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "b749db7f83bd86afe9ead3f07a3022239fb9a255", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/oikosbot", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "470bf747f8b023e074cd541228f94ff7bc95ea48", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/JuliaPackageSpitter.jl", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "fa6eb1f70799828a19d011b66037d5b0b1456b74", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@74d2f66f575246cf6e313ae7775f44df6e097ff2" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/nafa-app", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "5297f1e9a14f3ce5095445797895213494361480", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@8f2ee50841e216cd8c192eeb68953118190f105c" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/lustreiser", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "87dba59b6441fe8c9bb9313b201e95f3647e9669", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@c65436ee3351cd6b0fa14b142938b195efc77586" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/ponyiser", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "87dba59b6441fe8c9bb9313b201e95f3647e9669", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@c65436ee3351cd6b0fa14b142938b195efc77586" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/casket-ssg", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "d0065eeb3fecc13144edd53f4ab4bf20d33588e8", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/boj-server", + "default_branch": "main", + "archived": false, + "state": "custom_scanner_review", + "blob_sha": "323396c1565170d19728691f1d26983807f4c5e9", + "reusables": [], + "fast_pr_opt_in": false, + "has_inherit": false + }, + { + "repository": "hyperpolymath/cccp", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "d28c6292b776ecb6c9018b834eccb888b896dc2d", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@8f2ee50841e216cd8c192eeb68953118190f105c" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/otpiser", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "d0d10f13c6fff7e258245b381c2dc73e648d1d35", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@571cc734cd69fb846032ec77a662aa8ee4fc32cd" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/julia-professional-registry", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "34a5f018391ff03bf491a1281cae951757ec6f01", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/hermeneia", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "8ad7330f2c60ea148da002302d089cd45d887b3f", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/launch-scaffolder", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "fa6eb1f70799828a19d011b66037d5b0b1456b74", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@74d2f66f575246cf6e313ae7775f44df6e097ff2" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/nextgen-language-evangeliser", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "118b9a19a771a7460c2dcb41ca59a57e836fb68d", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/rsr-template-repo", + "default_branch": "main", + "archived": false, + "state": "custom_scanner_review", + "blob_sha": "eaea280d85a7af87884b3dd093eaa2d2cf33fd46", + "reusables": [], + "fast_pr_opt_in": false, + "has_inherit": false + }, + { + "repository": "hyperpolymath/echidnabot", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "e1e065cf885e4d26929dcdc3ba807e4f440f8809", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@740c9d7d4ed4d1f319a04c92b28218beb75668d7" + ], + "fast_pr_opt_in": false, + "has_inherit": false + }, + { + "repository": "hyperpolymath/affinescriptiser", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "87dba59b6441fe8c9bb9313b201e95f3647e9669", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@c65436ee3351cd6b0fa14b142938b195efc77586" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/bebop-ffi", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "9d8761db8f6264eadc7f047f596bd259e513b2c4", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/verisimdb", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "3ae918f283234cdb9c18a813b92d8249025da2e9", + "reusables": [ + "metadatastician/standards/.github/workflows/secret-scanner-reusable.yml@8e48b1caade08a552646adeab66558ac43b4360d" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/phronesiser", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "87dba59b6441fe8c9bb9313b201e95f3647e9669", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@c65436ee3351cd6b0fa14b142938b195efc77586" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/boinc-boinc", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "86bb8600d30e79c80b6564a646ba521eadb38221", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@8f2ee50841e216cd8c192eeb68953118190f105c" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/verisimiser", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "a9f9336709a37045185c8a01370753e236f9fb08", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@571cc734cd69fb846032ec77a662aa8ee4fc32cd" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/aspasia", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "fa6eb1f70799828a19d011b66037d5b0b1456b74", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@74d2f66f575246cf6e313ae7775f44df6e097ff2" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/i-human", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "78723a523ec0b36e858bea282a61afb9802e1f32", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@8f2ee50841e216cd8c192eeb68953118190f105c" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/statistikles", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "be27b43242c8a1ebfc4731ea56051f5de15a6bcd", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@210f14e753c80064ec1bcae72f1d654dd9b0e687" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/nimiser", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "87dba59b6441fe8c9bb9313b201e95f3647e9669", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@c65436ee3351cd6b0fa14b142938b195efc77586" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/somethings-fishy", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "3aab9fd13b8cf63084748db13151e03e43a167e8", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@571cc734cd69fb846032ec77a662aa8ee4fc32cd" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/echidna", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "fd1c6e1789075aeecf67c67967713b09372fe84a", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@3c00687a5bbd0d881d351db8502417b5d0a8b0b0" + ], + "fast_pr_opt_in": false, + "has_inherit": false + }, + { + "repository": "hyperpolymath/wokelangiser", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "cd20c58e920e7fdd7035b4ed2402354bd17b42d1", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@c65436ee3351cd6b0fa14b142938b195efc77586" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/resource-record-fluctuator", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "e0c459e311d5485ad9f499369c3a3a74b0dacba2", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/nextgen-databases", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "8a70caf2be0e5dbeb1b10a4c31db4bdc0a4949b9", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@fcb566cfb8a86cea2d3666bf65a4f177a49b1313" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/iseriser", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "502a4e7f172042f4f24087899201e97b128b2543", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@c65436ee3351cd6b0fa14b142938b195efc77586" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/system-et", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "5324c71a4c35ce6fdad12a08db647390380253d8", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@571cc734cd69fb846032ec77a662aa8ee4fc32cd" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/gitbot-fleet", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "dbac2872f23bafcd8eac91ed6b8a0e1986ace599", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66" + ], + "fast_pr_opt_in": false, + "has_inherit": false + }, + { + "repository": "hyperpolymath/bofig", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "3505f252f5c49df8ac66b319f8d72f60cc0b2e57", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@8f2ee50841e216cd8c192eeb68953118190f105c" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/bqniser", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "87dba59b6441fe8c9bb9313b201e95f3647e9669", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@c65436ee3351cd6b0fa14b142938b195efc77586" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/gsbot", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "b749db7f83bd86afe9ead3f07a3022239fb9a255", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/anytype", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "70acf4906c9afe21519196aa9ef892cf9fba7717", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@db12a6ad3ef9076d5f7bdcf98d7d15cf8547555a" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/ephapaxiser", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "87dba59b6441fe8c9bb9313b201e95f3647e9669", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@c65436ee3351cd6b0fa14b142938b195efc77586" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/sdp-hkdf-deployment", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "d931101a35b00e3fb0cdaff0ee4380f10499437d", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@571cc734cd69fb846032ec77a662aa8ee4fc32cd" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/robot-vacuum-cleaner", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "7ebe672a942a400ce5bb3fe77bd8559dacc5d9d2", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@571cc734cd69fb846032ec77a662aa8ee4fc32cd" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/accessibility-everywhere", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "837bfc1ad1e9d916a9cae9eab7d6793ae7b8d98a", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@c65436ee3351cd6b0fa14b142938b195efc77586" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/alloyiser", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "533f50497dc0f4410dee0bb9b7c8972a2baa14bb", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/dafniser", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "87dba59b6441fe8c9bb9313b201e95f3647e9669", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@c65436ee3351cd6b0fa14b142938b195efc77586" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/ochrance", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "dd78da5bc34fdb31f12100708c5268e3085a3563", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@c65436ee3351cd6b0fa14b142938b195efc77586" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/homebrew-tap", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "c81ce2fc698bd36c38d29633a8adbcc33acaefeb", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/squeakwell", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "87dba59b6441fe8c9bb9313b201e95f3647e9669", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@c65436ee3351cd6b0fa14b142938b195efc77586" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/excel-economic-numbers-tool", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "3b539df9eb37fc26455040aeb874f8ad6d086528", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@8f2ee50841e216cd8c192eeb68953118190f105c" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/futharkiser", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "87dba59b6441fe8c9bb9313b201e95f3647e9669", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@c65436ee3351cd6b0fa14b142938b195efc77586" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/mylangiser", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "502a4e7f172042f4f24087899201e97b128b2543", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@c65436ee3351cd6b0fa14b142938b195efc77586" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/boj-server-cartridges", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "893f32e88e4336026f81945358a93d97b3c02f34", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/docudactyl", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "d28c6292b776ecb6c9018b834eccb888b896dc2d", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@8f2ee50841e216cd8c192eeb68953118190f105c" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/typedqliser", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "089b04876e9702fc034a65c61a63a29c4fd7ec05", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@571cc734cd69fb846032ec77a662aa8ee4fc32cd" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/tlaiser", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "f0da137481f85f6168bc59b8bf32b17d05715b52", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/snapcreate", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "99e419a1cb53361d57aea282588d03467402d1aa", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@c65436ee3351cd6b0fa14b142938b195efc77586" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/sanctify-php", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "fc40165a060f40abe6c37ca660f6b78b032b490d", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@8f2ee50841e216cd8c192eeb68953118190f105c" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/cicd-suite", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "fa6eb1f70799828a19d011b66037d5b0b1456b74", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@74d2f66f575246cf6e313ae7775f44df6e097ff2" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/cicd-squabbler", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "0f2a0fe5cf6b9e4b964c508a872a4530e8e3a502", + "reusables": [ + "metadatastician/standards/.github/workflows/secret-scanner-reusable.yml@8e48b1caade08a552646adeab66558ac43b4360d" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/vcl-ut", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "ad7e1f417532218026f89fc8892c5539e7448025", + "reusables": [ + "metadatastician/standards/.github/workflows/secret-scanner-reusable.yml@8e48b1caade08a552646adeab66558ac43b4360d" + ], + "fast_pr_opt_in": false, + "has_inherit": false + }, + { + "repository": "hyperpolymath/chimichanga", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "fc40165a060f40abe6c37ca660f6b78b032b490d", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@8f2ee50841e216cd8c192eeb68953118190f105c" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/panic-attack", + "default_branch": "main", + "archived": false, + "state": "custom_scanner_review", + "blob_sha": "69cae32875a867f253d7cf14a8012b2d4cf79c81", + "reusables": [], + "fast_pr_opt_in": false, + "has_inherit": false + }, + { + "repository": "hyperpolymath/pons-asinorum", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "ae074c5dfd51848d07eea03e71ab6177fcab932b", + "reusables": [ + "metadatastician/standards/.github/workflows/secret-scanner-reusable.yml@cf8f91219d80da55cf8cbbfcd587d00c2d8798ed" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/mathesis", + "default_branch": "main", + "archived": false, + "state": "custom_scanner_review", + "blob_sha": "eaea280d85a7af87884b3dd093eaa2d2cf33fd46", + "reusables": [], + "fast_pr_opt_in": false, + "has_inherit": false + }, + { + "repository": "hyperpolymath/tree-navigator", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "d3f6bb1da5d4733ae65c7aa7139f15d94336bf10", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/fraying-model-computational-testbed", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "83d71d530d55c705da5b7f8d9aff4e1df1269caf", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@8f2ee50841e216cd8c192eeb68953118190f105c" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/supernorma", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "94ce1392626c2c9616e1a97029245aae1158ac14", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@571cc734cd69fb846032ec77a662aa8ee4fc32cd" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/januskey", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "74615429e348209cac8c1f289a6fa8be6946c698", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@a85aa8e70326cceedae169013a47daee554918b7" + ], + "fast_pr_opt_in": false, + "has_inherit": false + }, + { + "repository": "hyperpolymath/git-scripts", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "59c1e360810f7e4842936ec978b6b6c9415e89f8", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/trope-checker", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "2efb57dc481e4d15ff15590a7c05ec2f233e4f85", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@571cc734cd69fb846032ec77a662aa8ee4fc32cd" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/php-aegis", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "99e419a1cb53361d57aea282588d03467402d1aa", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@c65436ee3351cd6b0fa14b142938b195efc77586" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/laminar", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "4439d9f5c2ed31b91ec0d268facdfba2dae7fbc0", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@74d2f66f575246cf6e313ae7775f44df6e097ff2" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/checky-monkey", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "fc40165a060f40abe6c37ca660f6b78b032b490d", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@8f2ee50841e216cd8c192eeb68953118190f105c" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/Apodeixis.jl", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "c7a17d32c3ed9463e158b8f309420d7271a36ad9", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@b3ce78e1a8cb24b33fde5c9da6a7c09486efda78" + ], + "fast_pr_opt_in": false, + "has_inherit": false + }, + { + "repository": "hyperpolymath/blocky-writer", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "748f60ed78cf31656094ec46d1c1fdc9609e8210", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/project-wharf", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "2c4c526f8ca327188f928d0cd0f9d1e28ec65b8c", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@8f2ee50841e216cd8c192eeb68953118190f105c" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/puggle", + "default_branch": "main", + "archived": false, + "state": "custom_scanner_review", + "blob_sha": "eaea280d85a7af87884b3dd093eaa2d2cf33fd46", + "reusables": [], + "fast_pr_opt_in": false, + "has_inherit": false + }, + { + "repository": "hyperpolymath/InvestigativeJournalism.jl", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "118b9a19a771a7460c2dcb41ca59a57e836fb68d", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/TradeUnionism.jl", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "5a746bc4f11012df41da566cdf9b87885e562750", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@8f2ee50841e216cd8c192eeb68953118190f105c" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/Cladistics.jl", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "437776e6e660afdc47e474cb7e0fb1b49b01ca99", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/explore", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "a519b87f2ead26e7de67b0c4a5182de05a3cf215", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@571cc734cd69fb846032ec77a662aa8ee4fc32cd" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/ZeroProb.jl", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "437776e6e660afdc47e474cb7e0fb1b49b01ca99", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/zig-dnssec", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "9a7b13693636293bb682628625abcbbb0c90b2f4", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@da2c748aad55c1a1dcba00b60fe4a35017bc6540" + ], + "fast_pr_opt_in": false, + "has_inherit": false + }, + { + "repository": "hyperpolymath/haec", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "2efb57dc481e4d15ff15590a7c05ec2f233e4f85", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@571cc734cd69fb846032ec77a662aa8ee4fc32cd" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/Protoctist.jl", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "785d4288978e9c60cf1eb212136ce636911a2cd8", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@94572e612a7bf11f8e6343d19adadf17ef2a3de3" + ], + "fast_pr_opt_in": false, + "has_inherit": false + }, + { + "repository": "hyperpolymath/zig-boringtls", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "9a7b13693636293bb682628625abcbbb0c90b2f4", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@da2c748aad55c1a1dcba00b60fe4a35017bc6540" + ], + "fast_pr_opt_in": false, + "has_inherit": false + }, + { + "repository": "hyperpolymath/reposystem", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "c108dfab704b5c5b129aa04a6c81c709a64ebc50", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/universal-extension-format", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "5f305c596389e2212f14ebd7069db631b5e42c5a", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@c65436ee3351cd6b0fa14b142938b195efc77586" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/ResidualEvidenceTypes.jl", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "785d4288978e9c60cf1eb212136ce636911a2cd8", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@94572e612a7bf11f8e6343d19adadf17ef2a3de3" + ], + "fast_pr_opt_in": false, + "has_inherit": false + }, + { + "repository": "hyperpolymath/EpistemicTypes.jl", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "785d4288978e9c60cf1eb212136ce636911a2cd8", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@94572e612a7bf11f8e6343d19adadf17ef2a3de3" + ], + "fast_pr_opt_in": false, + "has_inherit": false + }, + { + "repository": "hyperpolymath/Cliodynamics.jl", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "1e9d1a220c420340c7b20af953c1910adf0111e4", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@619713b3aa1bbaaca174387537a9b089f728f9b9" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/neurophone", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "3399d53d0be4ea57cd6982008a241deed91e9f3f", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/Cliometrics.jl", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "1e9d1a220c420340c7b20af953c1910adf0111e4", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@619713b3aa1bbaaca174387537a9b089f728f9b9" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/PostDisciplinary.jl", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "cf463f2224766c7793a8c0e61a9301e2bb4473e0", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@d5fe075a50ab3ce4f41614d66ed77f152fda134f" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/Axiology.jl", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "437776e6e660afdc47e474cb7e0fb1b49b01ca99", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/JuliaKids.jl", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "71e66840691cb8e30971ad5cd5ab2aa1169bb63f", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/PRComms.jl", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "cf463f2224766c7793a8c0e61a9301e2bb4473e0", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@d5fe075a50ab3ce4f41614d66ed77f152fda134f" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/dotmatrix-fileprinter", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "cc2ccf761c5503c7a1f7bce2a207c8654a0cf76e", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/Exnovation.jl", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "437776e6e660afdc47e474cb7e0fb1b49b01ca99", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/my-lang", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "0e9ae661abb312bb33e7bca3707dab2a79c835ea", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/formatrix-docs", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "fbc20b2021853051aa85ca751c5909a7d3f460ed", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/maa-framework", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "fffde78cd00090b9a6b995797902dde55971010e", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/manifesto", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "5297f1e9a14f3ce5095445797895213494361480", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@8f2ee50841e216cd8c192eeb68953118190f105c" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/Axiom.jl", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "be19d7b27a339706996dd8857b303e83f0ef5af0", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@c65436ee3351cd6b0fa14b142938b195efc77586" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/http-capability-gateway", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "86bb8600d30e79c80b6564a646ba521eadb38221", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@8f2ee50841e216cd8c192eeb68953118190f105c" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/Skein.jl", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "097e739cf8497b3d4bb624016cb8cb2e4a16f5d4", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@fcb566cfb8a86cea2d3666bf65a4f177a49b1313" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/anvomidav", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "446116d1c053d0c773211b34b903b043f5595460", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@8f2ee50841e216cd8c192eeb68953118190f105c" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/docmatrix", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "d3f6bb1da5d4733ae65c7aa7139f15d94336bf10", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/BowtieRisk.jl", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "437776e6e660afdc47e474cb7e0fb1b49b01ca99", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/QuantumCircuit.jl", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "437776e6e660afdc47e474cb7e0fb1b49b01ca99", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/cloud-sync-tuner", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "3505f252f5c49df8ac66b319f8d72f60cc0b2e57", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@8f2ee50841e216cd8c192eeb68953118190f105c" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/marches", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "fa6eb1f70799828a19d011b66037d5b0b1456b74", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@74d2f66f575246cf6e313ae7775f44df6e097ff2" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/zerostep", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "fa6eb1f70799828a19d011b66037d5b0b1456b74", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@74d2f66f575246cf6e313ae7775f44df6e097ff2" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/bgp-backbone-lab", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "222db9d88890965cec3bd8ab43fa45cfeebf8b3f", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/thunderbird-template-reloaded", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "2ecd61d5a97216fac9c37ced8378b7b8cefe6cd0", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@c65436ee3351cd6b0fa14b142938b195efc77586" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/poly-k8s-mcp", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "fa6eb1f70799828a19d011b66037d5b0b1456b74", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@74d2f66f575246cf6e313ae7775f44df6e097ff2" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/vexometer", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "1330e9614209e52d081038187a1e4ffa865146f3", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@c65436ee3351cd6b0fa14b142938b195efc77586" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/tropical-types", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "9d8761db8f6264eadc7f047f596bd259e513b2c4", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/trope-particularity-workbench", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "c2fef4343b55816ba6348c0d9daae41858825d77", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@571cc734cd69fb846032ec77a662aa8ee4fc32cd" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/secret-types", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "2adeddcff8cf37414705c3ff65f329a64fef47bd", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66" + ], + "fast_pr_opt_in": false, + "has_inherit": false + }, + { + "repository": "hyperpolymath/wordpress-tools", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "8a86c96e7fd73a94421f8b15dea592d0f4427999", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@da2c748aad55c1a1dcba00b60fe4a35017bc6540" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/bofj-kitt", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "7e04f11dfe1bf10223b8254c3e39be3a049854b6", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@8f2ee50841e216cd8c192eeb68953118190f105c" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/heron-polyfeed-reader", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "9a7b13693636293bb682628625abcbbb0c90b2f4", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@da2c748aad55c1a1dcba00b60fe4a35017bc6540" + ], + "fast_pr_opt_in": false, + "has_inherit": false + }, + { + "repository": "hyperpolymath/recon-silly-ation", + "default_branch": "main", + "archived": false, + "state": "custom_scanner_review", + "blob_sha": "f6b387effed2a1f2ec3947046aa5c15345c9cb49", + "reusables": [], + "fast_pr_opt_in": false, + "has_inherit": false + }, + { + "repository": "hyperpolymath/feedback-o-tron", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "204ba295198b20852b71a4486753f9d311ba55c5", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@8f2ee50841e216cd8c192eeb68953118190f105c" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/Hyperpolymath.jl", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "437776e6e660afdc47e474cb7e0fb1b49b01ca99", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/universal-chat-extractor", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "8fb34d7c84ec314cf20523d772c96f23be2acba3", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/proof-burrower", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "2982ef102c320b87f487f0394354fc91dd7772b6", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66" + ], + "fast_pr_opt_in": false, + "has_inherit": false + }, + { + "repository": "hyperpolymath/panll", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "590c85a1be846507140231fc975a60fdd0587470", + "reusables": [ + "metadatastician/standards/.github/workflows/secret-scanner-reusable.yml@1fdc61c0c1c8f4c94324f956700d78d1ea9584a8" + ], + "fast_pr_opt_in": false, + "has_inherit": false + }, + { + "repository": "hyperpolymath/AcceleratorGate.jl", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "437776e6e660afdc47e474cb7e0fb1b49b01ca99", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/SMTLib.jl", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "437776e6e660afdc47e474cb7e0fb1b49b01ca99", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/ShellIntegration.jl", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "437776e6e660afdc47e474cb7e0fb1b49b01ca99", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/ssg-collection", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "86bb8600d30e79c80b6564a646ba521eadb38221", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@8f2ee50841e216cd8c192eeb68953118190f105c" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/git-reticulator", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "99e419a1cb53361d57aea282588d03467402d1aa", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@c65436ee3351cd6b0fa14b142938b195efc77586" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/laniakea", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "176cc209c52a06fa6f2b6801712419b1fc5348e1", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@80014df42eb81f09396c948299febb258cec4719" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/flat-mate", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "fa6eb1f70799828a19d011b66037d5b0b1456b74", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@74d2f66f575246cf6e313ae7775f44df6e097ff2" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/scripts", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "c108dfab704b5c5b129aa04a6c81c709a64ebc50", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/rpa-elysium", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "330e4db7c3beffff82e22bb54a4c6f7ccfdec6e0", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/twingate-helm-deploy", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "46d2042c77f6288e362c1e98358dc34270d78205", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@c65436ee3351cd6b0fa14b142938b195efc77586" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/kitchenspeak", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "fa6eb1f70799828a19d011b66037d5b0b1456b74", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@74d2f66f575246cf6e313ae7775f44df6e097ff2" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/hyperpolymath.github.io", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "be19d7b27a339706996dd8857b303e83f0ef5af0", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@c65436ee3351cd6b0fa14b142938b195efc77586" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/claude-gecko-browser-extension", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "6b7db34d1f0722c5e3c05534692d77622c829245", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/raze-tui", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "c928565a111d713ad29518ba9691babb6d8ddc2e", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@571cc734cd69fb846032ec77a662aa8ee4fc32cd" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/PolyglotFormalisms.jl", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "437776e6e660afdc47e474cb7e0fb1b49b01ca99", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/KnotTheory.jl", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "e3e2db127391279117f1ad0f666440dafbc32f8c", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/ensaid-spec", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "0f2cd44a80e275dafab54021a4adcb084296a3b0", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@c65436ee3351cd6b0fa14b142938b195efc77586" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/FirmwareAudit.jl", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "437776e6e660afdc47e474cb7e0fb1b49b01ca99", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/SiliconCore.jl", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "437776e6e660afdc47e474cb7e0fb1b49b01ca99", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/ipv6-site-enforcer", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "118b9a19a771a7460c2dcb41ca59a57e836fb68d", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/robodog-defensive-systems-lab", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "be19d7b27a339706996dd8857b303e83f0ef5af0", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@c65436ee3351cd6b0fa14b142938b195efc77586" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/live-files", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "fa6eb1f70799828a19d011b66037d5b0b1456b74", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@74d2f66f575246cf6e313ae7775f44df6e097ff2" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/HackenbushGames.jl", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "437776e6e660afdc47e474cb7e0fb1b49b01ca99", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/LowLevel.jl", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "fa6eb1f70799828a19d011b66037d5b0b1456b74", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@74d2f66f575246cf6e313ae7775f44df6e097ff2" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/HardwareResilience.jl", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "437776e6e660afdc47e474cb7e0fb1b49b01ca99", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/cloudflare-dns-terraform", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "fc40165a060f40abe6c37ca660f6b78b032b490d", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@8f2ee50841e216cd8c192eeb68953118190f105c" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/SoftwareSovereign.jl", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "437776e6e660afdc47e474cb7e0fb1b49b01ca99", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/wokelang", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "6c8ddaf1e3d7e8048d48e8ff0a7191d83863c7a6", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@c65436ee3351cd6b0fa14b142938b195efc77586" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/echo-types", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "8784f72005f9fb4a0a44aacd0cd6a5dbbc66f88e", + "reusables": [ + "metadatastician/standards/.github/workflows/secret-scanner-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66" + ], + "fast_pr_opt_in": false, + "has_inherit": false + }, + { + "repository": "hyperpolymath/epistemic-types", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "5f4c294040a23f0165591c82823ae654f9a704be", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/ochrance-framework", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "1c7ebb494ac1cc425e3c43f01cc26ce6aa2745e4", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@c65436ee3351cd6b0fa14b142938b195efc77586" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/ffmpeg-ffi", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "efac235c69598125e721785a70c8c5f8f4883510", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@092dedada188f56c5915f74a5fd40aac093742c3" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/ViableSystems.jl", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "437776e6e660afdc47e474cb7e0fb1b49b01ca99", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/nexia-list", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "7ebe672a942a400ce5bb3fe77bd8559dacc5d9d2", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@571cc734cd69fb846032ec77a662aa8ee4fc32cd" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/volumod", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "3b6e339cc60b7d78e1ace510062a146608683129", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@c65436ee3351cd6b0fa14b142938b195efc77586" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/polyglot-formalisms-elixir", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "fa6eb1f70799828a19d011b66037d5b0b1456b74", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@74d2f66f575246cf6e313ae7775f44df6e097ff2" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/betlang", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "d7e8e73d4a91fa882eb406f9fb6fa6b76d46b458", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/choreographic-types", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "6254c61fe18bcbccd37022abc6f11b905f24ed2e", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/typed-wasm", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "4256c8f5d9b1cf81770eef46f4882ee9d9b01c12", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@da2c748aad55c1a1dcba00b60fe4a35017bc6540" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/plasma-parser-writer", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "505c916c5a1ee37a1e77b0a985931afaf97309cf", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@c65436ee3351cd6b0fa14b142938b195efc77586" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/llm-grace", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "c9653414e7b32fba3b28df62ee1d454dd8cdc1ed", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@8f2ee50841e216cd8c192eeb68953118190f105c" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/lucidscript", + "default_branch": "main", + "archived": false, + "state": "custom_scanner_review", + "blob_sha": "20c2fa71b197989b538a0d92b9367d75e9cd1d6a", + "reusables": [], + "fast_pr_opt_in": false, + "has_inherit": false + }, + { + "repository": "hyperpolymath/vcs-ircd", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "a14ad055df0b106f608ebcaff3c8d988a30b0918", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/seamstress", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "3cd9ae564d91cf8f6530b50d5803ce3fdbc37983", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/ideas-to-alphas", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "fa6eb1f70799828a19d011b66037d5b0b1456b74", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@74d2f66f575246cf6e313ae7775f44df6e097ff2" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/jtv-lang", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "f6a2199389324be100b70f9af134f6457b9294e6", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/ephapax", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "80b7c85a9ec43646f64d8fbe92977fc787fa8b07", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@571cc734cd69fb846032ec77a662aa8ee4fc32cd" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/resource-algebra", + "default_branch": "main", + "archived": false, + "state": "custom_scanner_review", + "blob_sha": "d3a41232bcdc8380e371e05a06f4b84a4ebe814e", + "reusables": [], + "fast_pr_opt_in": false, + "has_inherit": false + }, + { + "repository": "hyperpolymath/MacroPower.jl", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "8dbd9290f9722652eac6cb0c07a6b01f5a404f4e", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@74d2f66f575246cf6e313ae7775f44df6e097ff2" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/modshells", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "c81ce2fc698bd36c38d29633a8adbcc33acaefeb", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/Causals.jl", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "437776e6e660afdc47e474cb7e0fb1b49b01ca99", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/empty-linter", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "8a45c8ea019fedb33bf6cf595bf8d1eb65bcb16b", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@8fd6c915c96073c818bfc42089a95936e80f265c" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/session-sentinel", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "319c5060fd1fac316bbc7ca62f473b8c3307753f", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@8f2ee50841e216cd8c192eeb68953118190f105c" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/ordinal-notation", + "default_branch": "main", + "archived": false, + "state": "custom_scanner_review", + "blob_sha": "eaea280d85a7af87884b3dd093eaa2d2cf33fd46", + "reusables": [], + "fast_pr_opt_in": false, + "has_inherit": false + }, + { + "repository": "hyperpolymath/aggregate-library", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "2bbec90fe3cc8faa67e14abab48a27c0dc0c7231", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@8f2ee50841e216cd8c192eeb68953118190f105c" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/patch-bridge", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "5a0295de8a97135886eaf7f7b6b4cd73e97251cb", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@571cc734cd69fb846032ec77a662aa8ee4fc32cd" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/gv-clade-index", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "8ef2ecea869a3aa5f12be138e85e879c97f4be2a", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@092dedada188f56c5915f74a5fd40aac093742c3" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/cloudguard-cli", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "fc40165a060f40abe6c37ca660f6b78b032b490d", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@8f2ee50841e216cd8c192eeb68953118190f105c" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/reasonably-good-token-vault", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "82693fb5b48f1c04814b04b34f3322c4942e2135", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/methodologies", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "fffde78cd00090b9a6b995797902dde55971010e", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/lithoglyph", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "b5f461c8eea65294163e88accf3b6a5bcf39a5f3", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@fcb566cfb8a86cea2d3666bf65a4f177a49b1313" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/hybrid-automation-router", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "c66e764bfc44c2032b52410caf4f33a9f358d382", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/proven-tests-and-benches", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "c355755aa20c8327d58d67ea232331f5b4179248", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/kea", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "8ef2ecea869a3aa5f12be138e85e879c97f4be2a", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@092dedada188f56c5915f74a5fd40aac093742c3" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/conflow", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "c1ed8ba1573d89afbcd271523787eeb2472578b7", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@8f2ee50841e216cd8c192eeb68953118190f105c" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/czech-file-knife", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "9a7b13693636293bb682628625abcbbb0c90b2f4", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@da2c748aad55c1a1dcba00b60fe4a35017bc6540" + ], + "fast_pr_opt_in": false, + "has_inherit": false + }, + { + "repository": "hyperpolymath/bitfuckit", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "e376e62276cfa0663175377081c1218f7781a6ff", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@74d2f66f575246cf6e313ae7775f44df6e097ff2" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/academic-workflow-suite", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "fa6eb1f70799828a19d011b66037d5b0b1456b74", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@74d2f66f575246cf6e313ae7775f44df6e097ff2" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/cookie-rebound", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "4c6d33cc5f87c9657baed465198f6bf78f91aa68", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@8f2ee50841e216cd8c192eeb68953118190f105c" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/zotero-tools", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "312b44015f7648b80d1229782d8c3acef37ff2a7", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/odds-and-sods-package-manager", + "default_branch": "main", + "archived": false, + "state": "custom_scanner_review", + "blob_sha": "17a5c0f3713c1e79f935a772a93b5a4d755eba43", + "reusables": [], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/asdf-tool-plugins", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "222db9d88890965cec3bd8ab43fa45cfeebf8b3f", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/proven-servers", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "6567c1a3fd3c761a0e737e0e7256ab3757e0e4fe", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/scaffoldia", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "2a2a3612133887a9641bfe24c410a1da9b0ba4c1", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@571cc734cd69fb846032ec77a662aa8ee4fc32cd" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/nesy-solver", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "02d1afc0d957199398c21aef646bd7bcf9c1d72c", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@571cc734cd69fb846032ec77a662aa8ee4fc32cd" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/ijson-jcs", + "default_branch": "main", + "archived": false, + "state": "not_at_standard_path" + }, + { + "repository": "hyperpolymath/krl", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "4f07df34db3be4a719f0718ff734e2196d90e81d", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@092dedada188f56c5915f74a5fd40aac093742c3" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/phronesis", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "2c6d6273f86f1d8d96a34d723d1c85a08740e526", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@571cc734cd69fb846032ec77a662aa8ee4fc32cd" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/explicit-trust-plane", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "5c85c725a6b11122a4c01d61a26649dc56192844", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@c65436ee3351cd6b0fa14b142938b195efc77586" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/im-docs", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "d3f6bb1da5d4733ae65c7aa7139f15d94336bf10", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/nickel-augmentation", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "fffde78cd00090b9a6b995797902dde55971010e", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/valence-shell", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "7016307feb3d779add516140131e11c90771395d", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@092dedada188f56c5915f74a5fd40aac093742c3" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/polyglot-i18n", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "0014882f8ea7495f2aabafc0bb4654555fc6af01", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@fad242d35291de1898242d6737ba02b74a59a2f2" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/contractiles", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "f868b15502e2154ec4833a6835cccd6e60b66c49", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@571cc734cd69fb846032ec77a662aa8ee4fc32cd" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/continuation-mesh", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "9d8761db8f6264eadc7f047f596bd259e513b2c4", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/deed-ecosystem", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "7813c8aa1d7982d199f0578d20a277e97491fda9", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@d5fe075a50ab3ce4f41614d66ed77f152fda134f" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/filesoup", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "c81ce2fc698bd36c38d29633a8adbcc33acaefeb", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/stateful-artefacts", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "243d8eabea38ee40a24284afd29b8f09f1ba7aeb", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/typell", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "45e84b508d0f9e0c578d60d2bf49c77dbf3582d3", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@8f2ee50841e216cd8c192eeb68953118190f105c" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/quandledb", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "467ae502ebd3e736acba47b4ab544c289d3d2a00", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@fcb566cfb8a86cea2d3666bf65a4f177a49b1313" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/nextgen-typing", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "533f50497dc0f4410dee0bb9b7c8972a2baa14bb", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/nextgen-languages", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "89a14381722e28be584b241b8f2d55baa9e78368", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a" + ], + "fast_pr_opt_in": false, + "has_inherit": false + }, + { + "repository": "hyperpolymath/panoply", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "e5ae8e43e098dbb17f66692b93880dc82a7fd8a0", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/coord-tui", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "f6a2199389324be100b70f9af134f6457b9294e6", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/safe-brute-force", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "ee3cec1b43a2c6c8021633cb4ff0f9b658cee7bf", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@c65436ee3351cd6b0fa14b142938b195efc77586" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/dicti0nary-attack", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "b21b7e9275d45c642bc0b2f00a468e84a5701640", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/cafescripto", + "default_branch": "main", + "archived": false, + "state": "custom_scanner_review", + "blob_sha": "20c2fa71b197989b538a0d92b9367d75e9cd1d6a", + "reusables": [], + "fast_pr_opt_in": false, + "has_inherit": false + }, + { + "repository": "hyperpolymath/patallm-gallery", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "a23fe0f2ff67187fdf4b3c5c08416ac54f60c3a7", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/eclexia", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "3efeb775b68c263897a8cce245d4c1377dc01fa5", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@da2c748aad55c1a1dcba00b60fe4a35017bc6540" + ], + "fast_pr_opt_in": false, + "has_inherit": false + }, + { + "repository": "hyperpolymath/voyage-enterprise-decision-system", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "2c590e4d2fcad25133eadf2f68071e13ebce767c", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@092dedada188f56c5915f74a5fd40aac093742c3" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/dictask", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "9a7b13693636293bb682628625abcbbb0c90b2f4", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@da2c748aad55c1a1dcba00b60fe4a35017bc6540" + ], + "fast_pr_opt_in": false, + "has_inherit": false + }, + { + "repository": "hyperpolymath/CoprocessorRuntime.jl", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "9a7b13693636293bb682628625abcbbb0c90b2f4", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@da2c748aad55c1a1dcba00b60fe4a35017bc6540" + ], + "fast_pr_opt_in": false, + "has_inherit": false + }, + { + "repository": "hyperpolymath/smtp-notify-action", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "fa6eb1f70799828a19d011b66037d5b0b1456b74", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@74d2f66f575246cf6e313ae7775f44df6e097ff2" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/jaffascript", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "66b72fc748a02de868ac46ea6234bfeac4cc70b1", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@2e12b312b529c51f095ce3b22cd35968f5aba898" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/polysafe-gitfixer", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "13f414d1605d29cc5b5b892cf1d318d95e195a69", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@092dedada188f56c5915f74a5fd40aac093742c3" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/oikos-economics-accounting-dsl", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "add58baa726711f3ad693cf2847544323f7a81d1", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@da2c748aad55c1a1dcba00b60fe4a35017bc6540" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/phantom-metal-taste", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "4abc0bb2bb29c43d44da5a0596dd16cbf2aa0c4d", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@da2c748aad55c1a1dcba00b60fe4a35017bc6540" + ], + "fast_pr_opt_in": false, + "has_inherit": false + }, + { + "repository": "hyperpolymath/natsci-studio", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "6e361d80375fd0b691ef3c924293e3b2c7bb799a", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@da2c748aad55c1a1dcba00b60fe4a35017bc6540" + ], + "fast_pr_opt_in": false, + "has_inherit": false + }, + { + "repository": "hyperpolymath/rattlescript", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "fa6eb1f70799828a19d011b66037d5b0b1456b74", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@74d2f66f575246cf6e313ae7775f44df6e097ff2" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/no-nonsense-nntps", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "fffde78cd00090b9a6b995797902dde55971010e", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/atsiser", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "fffde78cd00090b9a6b995797902dde55971010e", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/chapeliser", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "fffde78cd00090b9a6b995797902dde55971010e", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/network-ambulance", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "fc2bf441166368f19ccf8df0eb856a35ad4432dc", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/intsoc-transactor", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "78723a523ec0b36e858bea282a61afb9802e1f32", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@8f2ee50841e216cd8c192eeb68953118190f105c" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/ambientops", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "fa6eb1f70799828a19d011b66037d5b0b1456b74", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@74d2f66f575246cf6e313ae7775f44df6e097ff2" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/bactrian", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "c7a17d32c3ed9463e158b8f309420d7271a36ad9", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@b3ce78e1a8cb24b33fde5c9da6a7c09486efda78" + ], + "fast_pr_opt_in": false, + "has_inherit": false + }, + { + "repository": "hyperpolymath/quintessence", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "c7a17d32c3ed9463e158b8f309420d7271a36ad9", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@b3ce78e1a8cb24b33fde5c9da6a7c09486efda78" + ], + "fast_pr_opt_in": false, + "has_inherit": false + }, + { + "repository": "hyperpolymath/atoma", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "c7a17d32c3ed9463e158b8f309420d7271a36ad9", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@b3ce78e1a8cb24b33fde5c9da6a7c09486efda78" + ], + "fast_pr_opt_in": false, + "has_inherit": false + }, + { + "repository": "hyperpolymath/wsl-compute-governor-dispatcher", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "67eecae5eb243ea3594113174b17349d2476e133", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@571cc734cd69fb846032ec77a662aa8ee4fc32cd" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/developer-ecosystem", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "b9267d4fd427337228ac4219379f87d7c9776737", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@5b5dab9fb89c0ab7187ddc334d8995bd24392e41" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/rrecord-verity", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "c7fc77cb8618da3040c8b0b4bd03cded9616c6b4", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@8f2ee50841e216cd8c192eeb68953118190f105c" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/fireflag", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "1c7ebb494ac1cc425e3c43f01cc26ce6aa2745e4", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@c65436ee3351cd6b0fa14b142938b195efc77586" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/sinople-theme", + "default_branch": "", + "archived": false, + "state": "not_at_standard_path" + }, + { + "repository": "hyperpolymath/zig-unorm", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "9a7b13693636293bb682628625abcbbb0c90b2f4", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@da2c748aad55c1a1dcba00b60fe4a35017bc6540" + ], + "fast_pr_opt_in": false, + "has_inherit": false + }, + { + "repository": "hyperpolymath/double-track-browser", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "8afd7c9dc28d5986280e5febaecf39a17d4e079f", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@c59f24f76e02a8d4ecd2aea4309d185d7ed13128" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/xmlpull-zig", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "9a7b13693636293bb682628625abcbbb0c90b2f4", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@da2c748aad55c1a1dcba00b60fe4a35017bc6540" + ], + "fast_pr_opt_in": false, + "has_inherit": false + }, + { + "repository": "hyperpolymath/zig-icu-collation", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "9a7b13693636293bb682628625abcbbb0c90b2f4", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@da2c748aad55c1a1dcba00b60fe4a35017bc6540" + ], + "fast_pr_opt_in": false, + "has_inherit": false + }, + { + "repository": "hyperpolymath/EchoTypes.jl", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "b749db7f83bd86afe9ead3f07a3022239fb9a255", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/autoformal-fidelity", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "9a7b13693636293bb682628625abcbbb0c90b2f4", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@da2c748aad55c1a1dcba00b60fe4a35017bc6540" + ], + "fast_pr_opt_in": false, + "has_inherit": false + }, + { + "repository": "hyperpolymath/palimpsest-license", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "e345e28317a1fe9af1f5dc355ab4c09f98157f24", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/ipv6-tools", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "d6a5f10a761901697b15cfc7b8e818b26be0160f", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@a9a3281d620bdd195369c9a6f0bc1d661910965a" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/invariant-path", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "7ebe672a942a400ce5bb3fe77bd8559dacc5d9d2", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@571cc734cd69fb846032ec77a662aa8ee4fc32cd" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/sholes", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "572a548245953b1cf3feb9249c1003f80bc157f3", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@6a9251037760690d56022ad6fab2cfe9d887dd76" + ], + "fast_pr_opt_in": false, + "has_inherit": false + }, + { + "repository": "hyperpolymath/ipfs-overlay", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "352012aa9a41111275fbb7472c4b5e9d0251e088", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@da2c748aad55c1a1dcba00b60fe4a35017bc6540" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/unified-api-adapter", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "9a7b13693636293bb682628625abcbbb0c90b2f4", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@da2c748aad55c1a1dcba00b60fe4a35017bc6540" + ], + "fast_pr_opt_in": false, + "has_inherit": false + }, + { + "repository": "hyperpolymath/occupancy-types", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "785d4288978e9c60cf1eb212136ce636911a2cd8", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@94572e612a7bf11f8e6343d19adadf17ef2a3de3" + ], + "fast_pr_opt_in": false, + "has_inherit": false + }, + { + "repository": "hyperpolymath/social-media-polygraph", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "ffd8cfca32a7f996c203b27ec23632a7ff3d23d7", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/coq-jr", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "fffde78cd00090b9a6b995797902dde55971010e", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/verisimdb-data", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "5085e72fa526b6fd36419ee0d0acc8277a6a61a2", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@571cc734cd69fb846032ec77a662aa8ee4fc32cd" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/affinescript", + "default_branch": "main", + "archived": false, + "state": "custom_scanner_review", + "blob_sha": "55ad5dbd26f233e88a4016383d33079501f4b240", + "reusables": [], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/protocol-squisher", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "fc2bf441166368f19ccf8df0eb856a35ad4432dc", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/heterogenous-mobile-computing", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "748f60ed78cf31656094ec46d1c1fdc9609e8210", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/qubes-sdp", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "df0132c54bf9afb87e10ca201eba95619d184d93", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@a9a3281d620bdd195369c9a6f0bc1d661910965a" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/pseudoscript", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "02d71925778b1c12172bec6a2644492063d0f5e6", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@74d2f66f575246cf6e313ae7775f44df6e097ff2" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/cyo", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "b21b7e9275d45c642bc0b2f00a468e84a5701640", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/metadata-grammar", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "99e419a1cb53361d57aea282588d03467402d1aa", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@c65436ee3351cd6b0fa14b142938b195efc77586" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/grim-repo", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "99e419a1cb53361d57aea282588d03467402d1aa", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@c65436ee3351cd6b0fa14b142938b195efc77586" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/vext", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "811c3b737463db91cf5e4e0b1e417c1683f2bcc5", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@c65436ee3351cd6b0fa14b142938b195efc77586" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/anvomidaviser", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "82693fb5b48f1c04814b04b34f3322c4942e2135", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/anamnesis", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "fffde78cd00090b9a6b995797902dde55971010e", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/lol", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "2966fe5f636ee0b93cda834bb39489e5c3fe4932", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@210f14e753c80064ec1bcae72f1d654dd9b0e687" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/.github", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "3e3dcf25bc3a594b15fd1e3f7867d70e9d5df7ab", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/CompositionalDA.jl", + "default_branch": "main", + "archived": false, + "state": "not_at_standard_path" + }, + { + "repository": "hyperpolymath/CompositionalCounts.jl", + "default_branch": "main", + "archived": false, + "state": "not_at_standard_path" + }, + { + "repository": "hyperpolymath/deed-validate-action", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "68a44ce47b0ef541265469f23ba1f00a6d9b2f9f", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@210f14e753c80064ec1bcae72f1d654dd9b0e687" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/network-outpost", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "fa6eb1f70799828a19d011b66037d5b0b1456b74", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@74d2f66f575246cf6e313ae7775f44df6e097ff2" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/polyglot-formalisms-gleam", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "78723a523ec0b36e858bea282a61afb9802e1f32", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@8f2ee50841e216cd8c192eeb68953118190f105c" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/infrastructure-automation", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "118b9a19a771a7460c2dcb41ca59a57e836fb68d", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/self-destructing-git-garbage", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "67eecae5eb243ea3594113174b17349d2476e133", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@571cc734cd69fb846032ec77a662aa8ee4fc32cd" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/ddraig-ssg", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "b749db7f83bd86afe9ead3f07a3022239fb9a255", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/the-metadatastician", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "3e3dcf25bc3a594b15fd1e3f7867d70e9d5df7ab", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/tangle", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "381fc87e394309ff6a4199d2f7b2609ef1c5a550", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@c65436ee3351cd6b0fa14b142938b195efc77586" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/hyperpolymath", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "96bc071b8647ebb6d200a905af676d05e396a89f", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@c65436ee3351cd6b0fa14b142938b195efc77586" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/gnpl", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "cc641c6932486cab2443b2e15cefd1c85168dcf2", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@fcb566cfb8a86cea2d3666bf65a4f177a49b1313" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/oblibeny", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "8fb18160cd81fac9157322cab3d6b3411212dfe2", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@2479cf769ed5f0481ccf64860a2ab954514c2b59" + ], + "fast_pr_opt_in": false, + "has_inherit": false + }, + { + "repository": "hyperpolymath/glyphbase", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "4d4f39fdb466675e71402d16d2682d0c24acbc52", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@8f2ee50841e216cd8c192eeb68953118190f105c" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/residual-evidence-types", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "fa6eb1f70799828a19d011b66037d5b0b1456b74", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@74d2f66f575246cf6e313ae7775f44df6e097ff2" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/jtv-halting-islands-ct", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "b45221518ba1c268fa48f019c1e425e01aadd402", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@619713b3aa1bbaaca174387537a9b089f728f9b9" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/social-media-tools", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "841bb651eb1014f510a2aab52d09e59418a2876d", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/action-trust-layers", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "59c1e360810f7e4842936ec978b6b6c9415e89f8", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/claude-integrations", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "63e137ee73cb01972bb453cf5f0de4ca705ca84a", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@3108c1b01186741eea80c00da3f4beda912286f9" + ], + "fast_pr_opt_in": false, + "has_inherit": false + }, + { + "repository": "hyperpolymath/ipv6-only", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "118b9a19a771a7460c2dcb41ca59a57e836fb68d", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/firmboot", + "default_branch": "main", + "archived": false, + "state": "not_at_standard_path" + }, + { + "repository": "hyperpolymath/trigger", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "fa6eb1f70799828a19d011b66037d5b0b1456b74", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@74d2f66f575246cf6e313ae7775f44df6e097ff2" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/proven", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "164c11cbb51a4497a71815db2c27058347c849a0", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@571cc734cd69fb846032ec77a662aa8ee4fc32cd" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/ExactCounts.jl", + "default_branch": "main", + "archived": false, + "state": "not_at_standard_path" + }, + { + "repository": "hyperpolymath/ExactTests.jl", + "default_branch": "main", + "archived": false, + "state": "not_at_standard_path" + }, + { + "repository": "hyperpolymath/hesiod-dns-map", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "78723a523ec0b36e858bea282a61afb9802e1f32", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@8f2ee50841e216cd8c192eeb68953118190f105c" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/conative-gating", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "3b95b4ab0068a82774fd62ce087c589b8d1439af", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@8f2ee50841e216cd8c192eeb68953118190f105c" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/candy-crash", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "fc40165a060f40abe6c37ca660f6b78b032b490d", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@8f2ee50841e216cd8c192eeb68953118190f105c" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/cargo-zigbuild", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "741849e520be0e6d929313fcaa9a6b5ce5b4cc9f", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@571cc734cd69fb846032ec77a662aa8ee4fc32cd" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/ContrastFamilies.jl", + "default_branch": "main", + "archived": false, + "state": "not_at_standard_path" + }, + { + "repository": "hyperpolymath/civic-connect", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "fa6eb1f70799828a19d011b66037d5b0b1456b74", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@74d2f66f575246cf6e313ae7775f44df6e097ff2" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/misinformation-defence-platform", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "fa6eb1f70799828a19d011b66037d5b0b1456b74", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@74d2f66f575246cf6e313ae7775f44df6e097ff2" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/branch-newspaper", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "fa6eb1f70799828a19d011b66037d5b0b1456b74", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@74d2f66f575246cf6e313ae7775f44df6e097ff2" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/defiant", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "fa6eb1f70799828a19d011b66037d5b0b1456b74", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@74d2f66f575246cf6e313ae7775f44df6e097ff2" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/affinescript-vite", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "fa6eb1f70799828a19d011b66037d5b0b1456b74", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@74d2f66f575246cf6e313ae7775f44df6e097ff2" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/network-dashboard", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "78723a523ec0b36e858bea282a61afb9802e1f32", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@8f2ee50841e216cd8c192eeb68953118190f105c" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/oikosbot-estate", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "fa6eb1f70799828a19d011b66037d5b0b1456b74", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@74d2f66f575246cf6e313ae7775f44df6e097ff2" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/k9-ecosystem", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "b21b7e9275d45c642bc0b2f00a468e84a5701640", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/julia-ecosystem", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "80944a118962fe76dc4ca4ce2c5d425564e5ad58", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/neural-foundations", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "fa6eb1f70799828a19d011b66037d5b0b1456b74", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@74d2f66f575246cf6e313ae7775f44df6e097ff2" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/me-dialect", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "fa6eb1f70799828a19d011b66037d5b0b1456b74", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@74d2f66f575246cf6e313ae7775f44df6e097ff2" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/pimcore-fortress", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "c81ce2fc698bd36c38d29633a8adbcc33acaefeb", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/hpm-crypto-rsr", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "b749db7f83bd86afe9ead3f07a3022239fb9a255", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/kategoria", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "87dba59b6441fe8c9bb9313b201e95f3647e9669", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@c65436ee3351cd6b0fa14b142938b195efc77586" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/arghda-core", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "b749db7f83bd86afe9ead3f07a3022239fb9a255", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/cloudguard-server", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "d2bf15522703b79945c42e8d37615f18f04f5766", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@8f2ee50841e216cd8c192eeb68953118190f105c" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/flatracoon", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "7bd09556fc663ab83c9481a6200942104f893c6b", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/error-lang", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "b749db7f83bd86afe9ead3f07a3022239fb9a255", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/deed-core", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "2966fe5f636ee0b93cda834bb39489e5c3fe4932", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@210f14e753c80064ec1bcae72f1d654dd9b0e687" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/0patch-lsa-sentinel", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "1c85d011cc41790f557cea8197ce2a8aec079b91", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@571cc734cd69fb846032ec77a662aa8ee4fc32cd" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/refugia", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "162a38b60309ebd9349e2592e74574649b896744", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@c65436ee3351cd6b0fa14b142938b195efc77586" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/technical-notes", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "59c1e360810f7e4842936ec978b6b6c9415e89f8", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/snifs", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "cd821f16de425bfcc9cd7d9ec3886f6f1436a244", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@092dedada188f56c5915f74a5fd40aac093742c3" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/tentacles-agentic-syllabus", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "fa6eb1f70799828a19d011b66037d5b0b1456b74", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@74d2f66f575246cf6e313ae7775f44df6e097ff2" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/hpm-github-api-rsr", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "b749db7f83bd86afe9ead3f07a3022239fb9a255", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/universal-project-manager", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "a023dd4aaecfb5282f0792b9d143718e09232ebc", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@092dedada188f56c5915f74a5fd40aac093742c3" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/zerotier-k8s-link", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "5db93904a5e162232ee93481c095fc1796c6f735", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@c65436ee3351cd6b0fa14b142938b195efc77586" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/aerie", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "625b506c3bc2fd731d96a57dbf99b4f1836f5775", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@e13e2ea3dbbc9c7815e39c3749b4480514f555a6" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/veridical-simulation-core", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "3e3dcf25bc3a594b15fd1e3f7867d70e9d5df7ab", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/repo-guardian", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "fa6eb1f70799828a19d011b66037d5b0b1456b74", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@74d2f66f575246cf6e313ae7775f44df6e097ff2" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/hpm-json-rsr", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "b749db7f83bd86afe9ead3f07a3022239fb9a255", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4" + ], + "fast_pr_opt_in": false, + "has_inherit": true + }, + { + "repository": "hyperpolymath/hpm-http-client-rsr", + "default_branch": "main", + "archived": false, + "state": "review_candidate", + "blob_sha": "b749db7f83bd86afe9ead3f07a3022239fb9a255", + "reusables": [ + "hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4" + ], + "fast_pr_opt_in": false, + "has_inherit": true + } + ] +} diff --git a/scripts/inspect-pr-ci.sh b/scripts/inspect-pr-ci.sh new file mode 100644 index 0000000..4b38699 --- /dev/null +++ b/scripts/inspect-pr-ci.sh @@ -0,0 +1,89 @@ +#!/usr/bin/env bash +# SPDX-License-Identifier: MPL-2.0 +# Read-only evidence for humans and cicd-squabbler, not a merge authorisation. +# Usage: bash scripts/inspect-pr-ci.sh OWNER/REPO PR_NUMBER +set -euo pipefail +if [[ $# != 2 || ! $1 =~ ^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$ || ! $2 =~ ^[1-9][0-9]*$ ]]; then + echo 'usage: inspect-pr-ci.sh OWNER/REPO PR_NUMBER' >&2 + exit 2 +fi +for tool in gh jq; do + command -v "$tool" >/dev/null || { echo "$tool is required" >&2; exit 2; } +done +repo=$1 number=$2 +# Fetch all pages for an API endpoint and write their JSON values as an array. +# Fail if the API request or JSON parsing fails. +# gh versions before --slurp still emit one JSON document per API page. +paginated() { local endpoint=$1; gh api --paginate "$endpoint" | jq -s .; } +work=$(mktemp -d) +trap 'rm -rf "$work"' EXIT +# Errors are data, never an empty healthy population. Do not collect logs or +# artifacts: they can contain secrets and require additional network hosts. +# Save a probe's stdout and stderr under the given name in $work. On failure, +# replace stdout with a probe_error record; successful output rejected by jq -e +# returns 2. Errors writing the record can also reach the caller. +collect() { + local name=$1 + shift + if "$@" >"$work/$name.json" 2>"$work/$name.err"; then + jq -e 'true' "$work/$name.json" >/dev/null || return 2 + else + jq -n --rawfile error "$work/$name.err" '{probe_error:$error}' >"$work/$name.json" + fi +} +# Inspect the HTTP status, not an error message that merely mentions 404. +classic_protection() { + local response="$work/protection.http" rc=0 + gh api --include "$1" >"$response" || rc=$? + if (( rc != 0 )); then + if head -n 1 "$response" | grep -Eq '^HTTP/[0-9.]+ 404([[:space:]]|$)'; then + echo null + return 0 + fi + return "$rc" + fi + sed '1,/^\r\{0,1\}$/d' "$response" +} +collect pr gh pr view "$number" --repo "$repo" --json number,url,state,baseRefName,headRefOid,mergeable,mergeStateStatus,reviewDecision,statusCheckRollup +if jq -e 'has("probe_error")' "$work/pr.json" >/dev/null; then + cat "$work/pr.json" + exit 2 +fi +head=$(jq -er '.headRefOid' "$work/pr.json") +base=$(jq -er '.baseRefName' "$work/pr.json") +encoded_base=$(jq -rn --arg value "$base" '$value|@uri') +collect rules paginated "repos/$repo/rules/branches/$encoded_base" +collect protection classic_protection "repos/$repo/branches/$encoded_base/protection/required_status_checks" +# Both PR and push workflows count; a zero-job run never appears in rollup. +# Paginate rather than trusting gh run list's default limit of twenty. +collect runs paginated "repos/$repo/actions/runs?head_sha=$head&per_page=100" +if jq -e 'type=="array"' "$work/runs.json" >/dev/null; then + jq '[.[] | .workflow_runs[]] | group_by(.workflow_id,.event,.head_branch) | map(max_by(.run_number,.run_attempt))' \ + "$work/runs.json" >"$work/latest.json" + while IFS= read -r id; do + collect "jobs-$id" paginated "repos/$repo/actions/runs/$id/jobs?per_page=100" + jq -n --argjson id "$id" --slurpfile pages "$work/jobs-$id.json" \ + '{id:$id, result:$pages[0]}' >>"$work/jobs.jsonl" + done < <(jq -r '.[] | select(.status!="completed" or .conclusion!="success") | .id' "$work/latest.json") +else + cp "$work/runs.json" "$work/latest.json" +fi +: >>"$work/jobs.jsonl" +jq -n --arg repo "$repo" --arg observed_at "$(date -u +%FT%TZ)" \ + --slurpfile pr "$work/pr.json" --slurpfile rules "$work/rules.json" \ + --slurpfile protection "$work/protection.json" --slurpfile runs "$work/latest.json" \ + --slurpfile jobs "$work/jobs.jsonl" ' + {schema_version:1, observed_at:$observed_at, repository:$repo, + pr:$pr[0], rules:$rules[0], classic_required_checks:$protection[0], + latest_head_runs:$runs[0], non_success_run_jobs:$jobs, + zero_job_failures:[$jobs[] | . as $job | + select(any($runs[0][]?; .id==$job.id and .status=="completed" and .conclusion=="failure")) | + select(.result|type=="array") | + select(([.result[] | .jobs[]]|length)==0) | .id], + limitations:["Evidence only; never permission to merge or bypass a required context.", + "Runs queried for PR head SHA only; synthetic merge/merge-group runs are not covered.", + "PR rollup can be truncated by GitHub; rules and classic protection probes may be denied.", + "Zero jobs establish non-execution, not its cause. Use squabble zero-job/chains/fight.", + "Snapshot is not atomic; re-fetch after each head, policy or upstream change."]}' +# A report with denied probes is useful, but must not exit as a clean inspection. +if grep -q '"probe_error"' "$work/"*.json; then exit 2; fi diff --git a/templates/secret-scanner-caller.yml b/templates/secret-scanner-caller.yml new file mode 100644 index 0000000..bbf7816 --- /dev/null +++ b/templates/secret-scanner-caller.yml @@ -0,0 +1,23 @@ +# SPDX-License-Identifier: MPL-2.0 +# Keep scan / gitleaks: required by the estate Secret-Scan-Floor ruleset. +name: Secret Scanner +on: + pull_request: + push: + branches: [main] + schedule: + - cron: '23 3 * * 2' + workflow_dispatch: +permissions: + contents: read +concurrency: + # Scheduled/full audits and PR cancellation do not cancel one another. + group: secrets-${{ github.event_name }}-${{ github.ref }} + cancel-in-progress: true +jobs: + scan: + uses: hyperpolymath/cicd-suite/.github/workflows/secret-scanner-reusable.yml@__CICD_SUITE_SHA__ + with: + # Keep false until an initial full audit passes and the security owner + # accepts introduced-commit PR coverage. All non-PR runs remain full. + fast-pr: false diff --git a/tests/gate-action-owners.sh b/tests/gate-action-owners.sh index 22d7a41..85f4680 100755 --- a/tests/gate-action-owners.sh +++ b/tests/gate-action-owners.sh @@ -28,7 +28,7 @@ set -euo pipefail cd "$(dirname "$0")/.." ALLOWED_OWNERS='^(actions|github|hyperpolymath|dtolnay|swatinem|goto-bus-stop|taiki-e)$' -GATES=(rust-ci creusot-gate spark-gate kanren-gate) +GATES=(rust-ci creusot-gate spark-gate kanren-gate secret-scanner-reusable) command -v yq >/dev/null || { echo "yq is required (mikefarah v4)"; exit 2; } diff --git a/tests/inspect-pr-ci.sh b/tests/inspect-pr-ci.sh new file mode 100644 index 0000000..399462f --- /dev/null +++ b/tests/inspect-pr-ci.sh @@ -0,0 +1,81 @@ +#!/usr/bin/env bash +# SPDX-License-Identifier: MPL-2.0 +# Example-based regression controls, not formally proven tests. +set -euo pipefail +root=$(cd "$(dirname "$0")/.." && pwd) +work=$(mktemp -d) +trap 'rm -rf "$work"' EXIT +mkdir "$work/bin" +cat >"$work/bin/gh" <<'MOCK' +#!/usr/bin/env bash +set -euo pipefail +printf '%s\n' "$*" >>"$CALLS" +if [[ $1 == pr ]]; then + printf '%s\n' '{"number":1,"state":"OPEN","headRefOid":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","baseRefName":"release/test","mergeStateStatus":"BLOCKED","statusCheckRollup":[]}' +elif [[ $* == *'/rules/branches/'* ]]; then + if [[ ${DENIED:-0} == 1 ]]; then echo '403 rules denied' >&2; exit 1; fi + echo '[]' +elif [[ $* == *'/protection/'* ]]; then + if [[ ${PROTECTION_STATUS:-200} == 404 ]]; then + printf 'HTTP/2.0 404 Not Found\r\n\r\n{"message":"Not Found"}\n' + echo 'gh: Not Found (HTTP 404)' >&2; exit 1 + fi + if [[ ${PROTECTION_STATUS:-200} == 403 ]]; then + printf 'HTTP/2.0 403 Forbidden\r\n\r\n' + echo 'gh: denied (HTTP 403)' >&2; exit 1 + fi + if [[ ${PROTECTION_STATUS:-200} == error ]]; then + echo 'network failed while fetching /404' >&2; exit 1 + fi + printf 'HTTP/2.0 200 OK\r\nContent-Type: application/json\r\n\r\n{"contexts":["scan / gitleaks"]}\n' +elif [[ $* == *'/actions/runs?'* ]]; then + # Run 1 is a historical failure superseded by run 2. Run 3 has no jobs. + # The second API page contains run 4, which must not disappear. + echo '{"workflow_runs":[{"id":1,"workflow_id":10,"event":"pull_request","head_branch":"x","run_number":1,"status":"completed","conclusion":"failure"},{"id":2,"workflow_id":10,"event":"pull_request","head_branch":"x","run_number":2,"status":"completed","conclusion":"success"},{"id":3,"workflow_id":11,"event":"pull_request","head_branch":"x","run_number":1,"status":"completed","conclusion":"failure"}]} {"workflow_runs":[{"id":4,"workflow_id":12,"event":"push","head_branch":"x","run_number":1,"status":"completed","conclusion":"failure"}]}' | jq --arg status "${RUN_STATUS:-completed}" '.workflow_runs |= map(if .id==3 then .status=$status else . end)' +elif [[ $* == *'/runs/3/jobs?'* ]]; then + if [[ ${JOBS_DENIED:-0} == 1 ]]; then echo '403 jobs denied' >&2; exit 1; fi + echo '{"jobs":[]}' +elif [[ $* == *'/runs/4/jobs?'* ]]; then + echo '{"jobs":[{"id":99,"conclusion":"failure"}]}' +else + echo "unexpected call: $*" >&2; exit 1 +fi +MOCK +chmod +x "$work/bin/gh" +export PATH="$work/bin:$PATH" CALLS="$work/calls" +bash "$root/scripts/inspect-pr-ci.sh" owner/repo 1 >"$work/report.json" +jq -e '.classic_required_checks.contexts==["scan / gitleaks"] and .zero_job_failures==[3] and (.latest_head_runs|length)==3 and (.non_success_run_jobs|length)==2 and .pr.mergeStateStatus=="BLOCKED" and (.limitations|length)>0' "$work/report.json" >/dev/null +grep -q 'rules/branches/release%2Ftest' "$CALLS" +grep -q -- '--paginate' "$CALLS" +! grep -q '/runs/1/jobs' "$CALLS" +! grep -Eq 'merge|rerun|PATCH|POST|DELETE' "$CALLS" +echo 'ok: hidden zero-job failure, pagination, latest-run selection, branch encoding, read-only calls' +rc=0 +DENIED=1 bash "$root/scripts/inspect-pr-ci.sh" owner/repo 1 >"$work/denied.json" || rc=$? +[[ $rc == 2 ]] +jq -e '.rules.probe_error|contains("403")' "$work/denied.json" >/dev/null +echo 'ok: denied rules probe remains unknown, not healthy' +PROTECTION_STATUS=404 bash "$root/scripts/inspect-pr-ci.sh" owner/repo 1 >"$work/absent.json" +jq -e '.classic_required_checks == null' "$work/absent.json" >/dev/null +echo 'ok: absent classic protection is not a failed probe' +for status in 403 error; do + rc=0 + PROTECTION_STATUS=$status bash "$root/scripts/inspect-pr-ci.sh" owner/repo 1 >"$work/protection-error.json" || rc=$? + [[ $rc == 2 ]] + jq -e '.classic_required_checks.probe_error | length > 0' "$work/protection-error.json" >/dev/null +done +echo 'ok: denied and other failed protection probes remain errors' +rc=0 +JOBS_DENIED=1 bash "$root/scripts/inspect-pr-ci.sh" owner/repo 1 >"$work/jobs-denied.json" || rc=$? +[[ $rc == 2 ]] +jq -e '.zero_job_failures==[] and (.non_success_run_jobs[]|select(.id==3)|.result.probe_error|contains("403"))' "$work/jobs-denied.json" >/dev/null +echo 'ok: failed jobs probe is not mistaken for zero jobs' +rc=0 +bash "$root/scripts/inspect-pr-ci.sh" owner/repo invalid >"$work/invalid" 2>&1 || rc=$? +[[ $rc == 2 ]] +echo 'ok: invalid arguments refused' +rc=0 +RUN_STATUS=queued bash "$root/scripts/inspect-pr-ci.sh" owner/repo 1 >"$work/queued.json" || rc=$? +[[ $rc == 0 ]] +jq -e '.zero_job_failures==[] and any(.latest_head_runs[]; .id==3 and .status=="queued")' "$work/queued.json" >/dev/null +echo 'ok: queued empty job population is not a startup failure'