From e0bdd606c4b1f06f6d625a94323d010a7d7df2b0 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 19 Oct 2026 22:33:47 +0000 Subject: [PATCH] ci: drop secrets: inherit from the scanner The secret-scanner reusable (standards@75bd5994) declares no secrets and reads none; its gitleaks is a pinned local binary. The 'secrets: inherit is REQUIRED' header predates that and forwarded every repository secret for nothing. Co-Authored-By: Claude Sonnet 5.5 Claude-Session: https://claude.ai/code/session_01MF5GeeBBDF6sUzr6pZTjWV --- .github/workflows/secret-scanner.yml | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index 9ee3804..5f4c294 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -3,8 +3,10 @@ # Calls the estate's shared secret scanner (gitleaks + rust-secrets + # shell-secrets). Added because this repository had NO leak scanning at all. # -# `secrets: inherit` is REQUIRED — without it the gitleaks action's inner -# secrets.GITHUB_TOKEN is empty and the scan silently degrades. +# No `secrets:` line: the reusable workflow (standards@75bd5994) declares no +# secrets and reads none. Its gitleaks is a pinned local binary, and the +# GITHUB_TOKEN its jobs run under is governed by `permissions:`, not by secret +# passing. `secrets: inherit` would forward every repository secret for nothing. name: "Secret Scanner" on: pull_request: @@ -18,4 +20,3 @@ permissions: jobs: scan: uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66 - secrets: inherit