fix(security): remove unsupported secrets: inherit from the scanner contract; narrow remaining callers (#1108 §6b)

.github/workflows/github-backup-mirror-reusable.yml

@@ -41,7 +41,10 @@
 #   jobs:
 #     backup:
 #       uses: hyperpolymath/standards/.github/workflows/github-backup-mirror-reusable.yml@<sha>
-#       secrets: inherit
+#       secrets:
+#         # The callee's one declared (optional) secret. Not `secrets:
+#         # inherit` — that forwards every caller secret (standards#1108 §6b).
+#         BACKUP_MIRROR_TOKEN: ${{ secrets.BACKUP_MIRROR_TOKEN }}
 #
 # Required repo configuration:
 #   vars.BACKUP_MIRROR_ENABLED = 'true'      (opt in; off by default)

.github/workflows/governance.yml

@@ -17,4 +17,8 @@ permissions:
 jobs:
   governance:
     uses: ./.github/workflows/governance-reusable.yml
-    secrets: inherit
+    # Only the one secret the callee declares (optional). Was `secrets:
+    # inherit`, which forwarded every repo/org secret (standards#1108
+    # §6b); narrowed to the callee's declared contract.
+    secrets:
+      HYPATIA_SCAN_PAT: ${{ secrets.HYPATIA_SCAN_PAT }}

.github/workflows/hypatia-scan-reusable.yml

@@ -130,8 +130,8 @@ jobs:
           # code_scanning,secret_scanning}_alerts.ex). Without it those three
           # checks are skipped with "GITHUB_TOKEN not set" warnings.
           #
-          # Prefer a fine-grained, read-only PAT (HYPATIA_SCAN_PAT, inherited as
-          # an org secret via the caller's `secrets: inherit`): the built-in
+          # Prefer a fine-grained, read-only PAT (HYPATIA_SCAN_PAT, passed by
+          # the caller as this reusable's one declared secret): the built-in
           # Actions token CANNOT read Dependabot alerts (no `dependabot`
           # permission exists for it). Fall back to the built-in token so
           # code-scanning still works in repos where the PAT isn't present yet.

.github/workflows/hypatia-scan.yml

@@ -27,4 +27,9 @@ permissions:
 jobs:
   scan:
     uses: ./.github/workflows/hypatia-scan-reusable.yml
-    secrets: inherit
+    # Only the callee's one declared secret. Was `secrets: inherit`,
+    # which forwarded every repo/org secret (standards#1108 §6b); the
+    # reusable now declares HYPATIA_SCAN_PAT explicitly so it can be
+    # passed narrowly.
+    secrets:
+      HYPATIA_SCAN_PAT: ${{ secrets.HYPATIA_SCAN_PAT }}

.github/workflows/mirror-reusable.yml

@@ -14,11 +14,13 @@
 # `vars.<FORGE>_MIRROR_ENABLED == 'true'`, so forge selection is
 # configured per-repo via Actions vars — no per-call inputs required.
 #
-# Callers pass explicit secrets (preferred) or `secrets: inherit` so the reusable
-# can read the per-forge SSH keys (GITLAB_SSH_KEY, BITBUCKET_SSH_KEY,
-# CODEBERG_SSH_KEY, SOURCEHUT_SSH_KEY, DISROOT_SSH_KEY, GITEA_SSH_KEY)
-# and RADICLE_KEY from the caller repo. Without a passed secret,
-# `${{ secrets.X }}` inside the reusable evaluates to empty.
+# Callers pass the per-forge SSH keys EXPLICITLY, by the names declared in
+# `workflow_call.secrets` below (GITLAB_SSH_KEY, BITBUCKET_SSH_KEY,
+# CODEBERG_SSH_KEY, SOURCEHUT_SSH_KEY, DISROOT_SSH_KEY, GITEA_SSH_KEY,
+# RADICLE_KEY). Do not use `secrets: inherit`: it forwards every repo/org
+# secret the caller can see, not just these seven (standards#1108 §6b).
+# Without a passed secret, `${{ secrets.X }}` inside the reusable
+# evaluates to empty and that forge's job no-ops.
 #
 # Caller example (wrapper):
 #   # SPDX-License-Identifier: MPL-2.0

.github/workflows/mirror.yml

@@ -15,4 +15,15 @@ permissions:
 jobs:
   mirror:
     uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@b935e63937b1f1b5cbaeea7e375947d7b924038f
-    secrets: inherit
+    # Exactly the seven optional secrets the callee declares at the
+    # pinned SHA (verified declared ⊇ referenced). Was `secrets:
+    # inherit`, which forwarded every repo/org secret (standards#1108
+    # §6b; the old convention is tracked in #943).
+    secrets:
+      GITLAB_SSH_KEY: ${{ secrets.GITLAB_SSH_KEY }}
+      BITBUCKET_SSH_KEY: ${{ secrets.BITBUCKET_SSH_KEY }}
+      CODEBERG_SSH_KEY: ${{ secrets.CODEBERG_SSH_KEY }}
+      SOURCEHUT_SSH_KEY: ${{ secrets.SOURCEHUT_SSH_KEY }}
+      DISROOT_SSH_KEY: ${{ secrets.DISROOT_SSH_KEY }}
+      GITEA_SSH_KEY: ${{ secrets.GITEA_SSH_KEY }}
+      RADICLE_KEY: ${{ secrets.RADICLE_KEY }}

.github/workflows/secret-scanner-reusable.yml

@@ -29,10 +29,17 @@
 #     internally (rust-secrets exits early on no Cargo.toml; shell-secrets
 #     no-ops on no .sh/.bash files), so there is nothing for the caller
 #     to toggle.
-#   - Caller MUST use `secrets: inherit` so the gitleaks-action's
-#     `GITHUB_TOKEN` reference resolves. Without `secrets: inherit`,
-#     the inner `secrets.GITHUB_TOKEN` is empty and gitleaks falls back
-#     to anonymous mode (rate-limited; misses some PRs).
+#   - Caller passes NO `secrets:` line. This reusable declares no
+#     `workflow_call.secrets` and references no `secrets.*` context:
+#     gitleaks runs as a pinned local binary (see the PERMISSIONS note),
+#     and the `GITHUB_TOKEN` the jobs act under is governed by
+#     `permissions:`, not by caller secret passing. `secrets: inherit`
+#     would forward every repository and organisation secret the caller
+#     can see (CWE-250) and buy nothing. An earlier version of this
+#     header claimed inherit was REQUIRED so `gitleaks/gitleaks-action`
+#     could see `secrets.GITHUB_TOKEN`; that claim died with #500 but
+#     kept propagating into generated callers estate-wide. Do not
+#     re-add it. (standards#1108 §6b)
 #   - Caller keeps its own `on:` triggers and `concurrency:` group, so
 #     the read-only cancel-superseded behaviour stays in the wrapper.
 #   - Trufflehog removed: gitleaks provides sufficient coverage at lower cost.

.github/workflows/secret-scanner.yml

@@ -46,4 +46,7 @@ jobs:
     # `gh run list --json conclusion`. Between these two faults, this repo's own
     # secret scanning did not execute — while a live credential sat in the tree.
     uses: ./.github/workflows/secret-scanner-reusable.yml
-    secrets: inherit
+    # No `secrets:` line, by design: the reusable declares no
+    # `workflow_call.secrets` and references no `secrets.*`. This file
+    # previously ended in `secrets: inherit`, forwarding every repo/org
+    # secret to a scanner that needs none (standards#1108 §6b).

.hypatia-baseline.json

@@ -263,42 +263,6 @@
   "expires_at": "2026-12-22",
   "tracking_issue": "hyperpolymath/standards#941"
  },
- {
-  "severity": "warn",
-  "rule_module": "workflow_hardening",
-  "type": "WH008",
-  "file": ".github/workflows/mirror.yml",
-  "note": "ACCEPTED ESTATE CONVENTION (hypatia triage 2026-09-22): reusable-workflow callers use `secrets: inherit` by design.",
-  "expires_at": "2026-12-22",
-  "tracking_issue": "hyperpolymath/standards#943"
- },
- {
-  "severity": "warn",
-  "rule_module": "workflow_hardening",
-  "type": "WH008",
-  "file": ".github/workflows/hypatia-scan.yml",
-  "note": "ACCEPTED ESTATE CONVENTION (hypatia triage 2026-09-22): reusable-workflow callers use `secrets: inherit` by design.",
-  "expires_at": "2026-12-22",
-  "tracking_issue": "hyperpolymath/standards#943"
- },
- {
-  "severity": "warn",
-  "rule_module": "workflow_hardening",
-  "type": "WH008",
-  "file": ".github/workflows/governance.yml",
-  "note": "ACCEPTED ESTATE CONVENTION (hypatia triage 2026-09-22): reusable-workflow callers use `secrets: inherit` by design.",
-  "expires_at": "2026-12-22",
-  "tracking_issue": "hyperpolymath/standards#943"
- },
- {
-  "severity": "warn",
-  "rule_module": "workflow_hardening",
-  "type": "WH008",
-  "file": ".github/workflows/secret-scanner.yml",
-  "note": "ACCEPTED ESTATE CONVENTION (hypatia triage 2026-09-22): reusable-workflow callers use `secrets: inherit` by design.",
-  "expires_at": "2026-12-22",
-  "tracking_issue": "hyperpolymath/standards#943"
- },
  {
   "severity": "high",
   "rule_module": "workflow_hardening",

1-formats/a2ml/meta/.github/workflows/scorecard-enforcer.yml

@@ -17,5 +17,5 @@ jobs:
     permissions:
       contents: read
       security-events: write
-    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@210f14e753c80064ec1bcae72f1d654dd9b0e687
-    secrets: inherit
+    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@8ff9ce65f7e54f8d5c5aa94584e2ead0f2ba460f
+    # No `secrets:` line: the reusable declares none (standards#1108 §6b).

1-formats/a2ml/meta/.github/workflows/scorecard.yml

@@ -15,5 +15,5 @@ jobs:
     permissions:
       contents: read
       security-events: write
-    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@210f14e753c80064ec1bcae72f1d654dd9b0e687
-    secrets: inherit
+    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@8ff9ce65f7e54f8d5c5aa94584e2ead0f2ba460f
+    # No `secrets:` line: the reusable declares none (standards#1108 §6b).

1-formats/a2ml/meta/.github/workflows/secret-scanner.yml

@@ -17,5 +17,5 @@ jobs:
   scan:
     permissions:
       contents: read
-    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@210f14e753c80064ec1bcae72f1d654dd9b0e687
-    secrets: inherit
+    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@8ff9ce65f7e54f8d5c5aa94584e2ead0f2ba460f
+    # No `secrets:` line: the reusable declares none (standards#1108 §6b).

2-protocols/0-ai-gatekeeper/.github/workflows/scorecard.yml

@@ -23,5 +23,5 @@ jobs:
     permissions:
       contents: read
       security-events: write
-    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@210f14e753c80064ec1bcae72f1d654dd9b0e687
-    secrets: inherit
+    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@8ff9ce65f7e54f8d5c5aa94584e2ead0f2ba460f
+    # No `secrets:` line: the reusable declares none (standards#1108 §6b).

2-protocols/0-ai-gatekeeper/.github/workflows/secret-scanner.yml

@@ -17,5 +17,5 @@ jobs:
   scan:
     permissions:
       contents: read
-    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@210f14e753c80064ec1bcae72f1d654dd9b0e687
-    secrets: inherit
+    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@8ff9ce65f7e54f8d5c5aa94584e2ead0f2ba460f
+    # No `secrets:` line: the reusable declares none (standards#1108 §6b).

CICD-WORKFLOW-CATALOG.md

@@ -333,8 +333,14 @@ These should **call** the reusable workflow instead of copying:
 ```yaml
 jobs:
   governance:
-    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@main
-    secrets: inherit
+    permissions:
+      contents: read
+    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@<full-40-char-commit-sha>
+    # Add a `secrets:` block ONLY when the callee declares named secrets
+    # under `workflow_call.secrets`, passing each by name. Never use
+    # `secrets: inherit` — it forwards every repo/org secret the caller
+    # can see (standards#1108 §6b). Most reusables (e.g. the secret
+    # scanner) declare none and need no `secrets:` line at all.
 ```
 
 ### For Non-Reusable Workflows