Repository navigation
fix: restore post-merge scanner startup and preserve supplemental coverage - #64
Conversation
Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 49 minutes. View limit details
No actionable comments were generated in the recent review.
 |
| Layer / File(s) | Summary |
|---|---|
Update scanner workflow references .github/workflows/secret-scanner.yml, .github/workflows/secret-scanner-legacy.yml |
The scan job uses a new reusable-workflow commit. The legacy workflow is described as a comparison bundle, with secret-scanner.yml identified as owning the required scan / gitleaks context. The legacy workflow’s repository reference changes to metadatastician/standards; its workflow path and commit remain unchanged. |
Estimated code review effort: 1 (Trivial) | ~5 minutes
Change: Bug fix
Possibly related PRs
- hyperpolymath/cicd-suite#62: Introduced the scanner workflows and pinned reusable-workflow callers that this pull request updates.
Merge Risk: 
c47af
-
The workflow changes are locally compatible. Complete the documented live and policy validation before rollout.
Pre-merge checks: 
-
Check name Status Explanation Title check The title clearly identifies the scanner startup fix and preservation of supplemental coverage. It matches the workflow pin and legacy caller changes. Linked Issues check Check skipped because no linked issues were found for this pull request. Out of Scope Changes check Check skipped because no linked issues were found for this pull request. Description check The description is specific and related to the changeset. It explains that the scanner is repinned to published main commit d285b0a, that the legacy caller moves to metadatastician/standards, and that… Full details: Description check
-
Explanation
The description is specific and related to the changeset. It explains that the scanner is repinned to published main commit d285b0a, that the legacy caller moves to metadatastician/standards, and that supplemental detector ports replace the remote bundle. It also lists validation results and a rollout boundary, which match the workflow changes and PR objectives.
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Comment @coderabbitai help to get the list of available commands.
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
…ial controls Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>
…icts Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>
|
) ## Next stage after #64 - Advances the suite caller to published merge SHA 41f8a32, including the integrated Gitleaks/Rust/shell verdict. No intermediate PR pin. - Adds read-only full-history corpus audits of three pinned public default-branch snapshots: unified-dataset-vocab, idrisiser and gitbot-fleet. These do not modify consumers or execute their code. - Found fleet rules explicitly require scan / rust-secrets and scan / shell-secrets as well as scan / gitleaks. Adds SHA-bound result receipts and compatibility result jobs without duplicating full scans or removing requirements. - Tests the exact result-job shell from parsed YAML: findings, infrastructure errors, timeouts, missing receipts, cancellation, skipping and mismatched subjects cannot pass. Integration fixtures test actual receipt emission. - Restricts corpus audits to PR context after CodeQL flagged the unnecessary manual-dispatch surface. The alert is fixed, not suppressed. ## Current-head evidence (0f0500f) All current-head checks and workflow runs passed, including CodeQL, SonarCloud, GitGuardian, Semgrep, audit and control suites. - Suite caller: 9-second job, success (41154022526). - Corpus audit jobs: unified-dataset-vocab 8s; idrisiser 8s; gitbot-fleet 14s (41154022359). - Real detector, differential, publication and receipt controls: 27-second PR job, success (41154022420). ## Important rollout boundary No consumer caller or policy has been changed. Corpus audits use published suite 41f8a3; they do not prove consumer Actions admission, consumer lock-sync or PR merge readiness. The added compatibility jobs are tested at source level but must be witnessed through real consumer callers after publication. Review and merge normally to publish this implementation. Then pin representative consumer PRs to this PR's resulting main SHA (not an intermediate PR commit), verify all required contexts and consumer-specific lock rules, and expand only after those canaries pass. Full history stays the default; no admin override, dropped required context, broad permission grant or global suppression is part of this change. --------- Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>
Fixes
scan / gitleaksusing the published main commit d285b0a, not a pre-squash PR SHA. The old run explicitly saidworkflow was not found.Validation on current head 1574030
scan / gitleakspassed in 10 seconds (41147150838).Publishing/rollout boundary
The current production caller deliberately remains pinned to already-published d285b0a; standalone supplement jobs preserve this repository's additional checks now. Merge this implementation first, observe main, then use the resulting main SHA for integrated consumer canaries. Do not pin production callers to intermediate commits from this PR.
No consumer repositories have been edited, no admin merge performed, no required context removed, and no admission policy expanded. Full-history remains the default. See docs/SCANNER-STARTUP-AND-PARITY.adoc. Empirical fixtures are not a whole-estate equivalence proof.