feat(governance): add secret-scanner-reusable.yml — propagate shell-secrets to 281 repos

[hyperpolymath]

Summary

Extends the reusable-workflow pattern from #168 / #174 / #187 to secret-scanner.yml. Same shape as #187 (no per-call inputs except runs-on; caller uses secrets: inherit).

Why secret-scanner is the next foundational reusable

Estate drift survey (gh api /search/code paginated against org:hyperpolymath, blob-SHA grouped over all 281 deployments):

Metric	Value
Total deployments	281
Unique blob SHAs	54
Structural drift	19% (top 4 SHAs cover 69%, top 6 cover 79%)
Feature variance	near-zero — all sampled variants carry the same 3 jobs (trufflehog + gitleaks + rust-secrets) at 75-81 lines
True drift source	action-SHA pin churn + whitespace

The 100-sample drift estimate (55%) initially ranked secret-scanner third behind mirror; the full pagination reveals the actual figure is 19%. The variance was a sampling artefact.

Security debt this PR force-fixes

The shell-secrets job was added to the canonical 2026-05-21 (commit 080c394) in direct response to the live Cloudflare API token leak via avow-protocol/deploy-repos.sh (commit 5f2f8b2) — a leak that both trufflehog --only-verified and default gitleaks missed.

Of 16 estate secret-scanner.yml blobs sampled across the top + long-tail SHAs, 0 carry the shell-secrets job.

The post-incident guardrail intended to catch the next such leak has propagated to nothing. Consolidating the workflow behind this reusable means the wrapper sweep that follows this PR force-promotes shell-secrets to all 281 repos in one batch.

Design

• No per-call inputs other than runs-on — each job self-conditions internally:
  • rust-secrets exits early on no Cargo.toml (safe on every repo)
  • shell-secrets no-ops without .sh/.bash files
  • trufflehog + gitleaks always-on (intended)
• secrets: inherit required at the call site — so the inner secrets.GITHUB_TOKEN reference in the gitleaks-action step resolves. Without inherit it falls back to anonymous mode (rate-limited; misses some PRs).
• Caller keeps on: + concurrency: — so the read-only cancel-superseded guardrail stays in the wrapper.
• SPDX header, top-level permissions: contents: read, all actions SHA-pinned — passes the workflow-lint job in governance-reusable.yml.

Caller wrapper shape (post-merge)

# SPDX-License-Identifier: PMPL-1.0-or-later
name: Secret Scanner
on:
  pull_request:
  push:
    branches: [main]
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true
permissions:
  contents: read
jobs:
  scan:
    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@<sha>
    secrets: inherit

~12 lines per repo, replacing ~75-116 lines.

Rollout plan

NOT started in this PR — owner-gated, same as #187 / #174 sweeps.

Wave	Repos	Action
1: bulk-mechanical	~275	Canonical 3-job match. Fan-out single-commit wrapper PR per repo, pinned to this PR HEAD; rebase to merged-main SHA before batch firing.
2: slim variants	~6	Repos with 2-job (missing rust-secrets) or 1-job (trufflehog only) older copies. Standardize-up safely since the missing job self-skips on non-applicable repos.

Total expected sweep: ~281 PRs (well above the 82-PR rust-ci precedent — recommend batching by wave; user gates each wave start).

Pattern hardening

• Same workflow_call shape as refactor(governance): subsume language-policy.yml + add deno-ci-reusable (semantics-level fix for estate-template drift) #168 / feat(governance): add rust-ci-reusable + elixir-ci-reusable workflows #174 / feat(governance): add mirror-reusable.yml — consolidate 289-repo mirror.yml drift #187 — no new infrastructure.
• Independent of feat(governance): add rust-ci-reusable + elixir-ci-reusable workflows #174 (rust-ci-reusable.yml), fix(baseline): file_pattern glob matching + jq scoping bugs #180 (apply-baseline.sh glob fix), and feat(governance): add mirror-reusable.yml — consolidate 289-repo mirror.yml drift #187 (mirror-reusable.yml) — no file conflicts; lands in any order.

🤖 Generated with Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 118 issues detected

Severity	Count
🔴 Critical	64
🟠 High	43
🟡 Medium	11

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Action hyperpolymath/standards/.github/workflows/deno-ci-reusable.yml@main needs attention",
    "type": "unpinned_action",
    "file": "deno-ci-reusable.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Action hyperpolymath/standards/.github/workflows/governance-reusable.yml@main needs attention",
    "type": "unpinned_action",
    "file": "governance-reusable.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Action hyperpolymath/standards/.github/workflows/governance-reusable.yml@main needs attention",
    "type": "unpinned_action",
    "file": "governance.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Python file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/standards/standards/a2ml-templates/state-scm-to-v2.py",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/standards/standards/a2ml/bindings/deno/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/standards/standards/lol/test/vitest.config.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/standards/standards/k9-svc/bindings/deno/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "Agda postulate assumes without proof -- potential soundness hole (4 occurrences, CWE-704)",
    "type": "agda_postulate",
    "file": "/home/runner/work/standards/standards/lol/proofs/theories/information_theory.agda",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "critical"
  },
  {
    "reason": "believe_me undermines formal verification (1 occurrences, CWE-704)",
    "type": "believe_me",
    "file": "/home/runner/work/standards/standards/lol/src/abi/Locale.idr",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "critical"
  },
  {
    "reason": "Wildcard CORS -- restrict to specific origins or use env var (1 occurrences, CWE-942)",
    "type": "js_wildcard_cors",
    "file": "/home/runner/work/standards/standards/consent-aware-http/examples/reference-implementations/deno/aibdp_middleware.js",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence