Ci/secret scanner caller perms

[hyperpolymath]

Summary

Closes #

Type of change

• 🐛 Bug fix (non-breaking change that fixes an issue)
• ✨ New feature (non-breaking change that adds functionality)
• 💥 Breaking change (would change existing behaviour)
• 🕳️ Soundness fix (fixes a checker/proof false-negative)
• 📖 Documentation
• 🧹 Refactor / tech debt (behaviour-preserving)
• ⚡ Performance
• 🔧 Build / CI / tooling

How has this been verified?

Checklist

• My commits are signed (git commit -S).
• I ran the project's own checks/tests locally and they pass.
• New files carry the correct SPDX-License-Identifier (code/config MPL-2.0,
  prose CC-BY-SA-4.0); I did not relicense existing files.
• Docs are updated, and no public claim now overstates what the code does.
• I have not introduced a soundness hole (or I have flagged where I might have).

Notes for reviewers

---

Summary by Gitar

• CI / Security workflows:
  • Standardized secret scanning across estate on TruffleHog via reusable workflows
  • Adopted standardized reusable workflows for Scorecard, Hypatia, and Governance
  • Switched CI callers to permissionless reusable workflow configuration
• Governance & Documentation:
  • Added repository governance model in GOVERNANCE.adoc alongside CODEOWNERS and MAINTAINERS.adoc
• Refactoring & Standardization:
  • Renamed agent_instructions to bot_directives for spec alignment and cleaned up contractiles across subprojects

_{This will update automatically on new commits.}

[sonarqubecloud]

Quality Gate failed

Failed conditions
C Security Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE

[gitar-bot]

Note

Automatic reviews are paused because your trial's included automatic processing has been used for this period. Upgrade now, or comment "Gitar review" to run a review anytime.
Learn more

Code Review 👍 Approved with suggestions 2 resolved / 3 findings

Adopts standardized CI workflows and secret scanning on TruffleHog, but the root secret-scanner job uses unpinned action refs, runs duplicate overlapping scans, and contains a broken shell operator precedence in the justfile.

💡 Bug: Justfile llm-context recipe has broken && / || precedence

📄 Justfile:54

test -f README.adoc && head -30 README.adoc || test -f README.md && head -30 README.md || echo "No README found" chains left-to-right, so when README.adoc exists and prints, the shell still evaluates && head -30 README.md, printing the .md too or (when absent) falling through to || echo "No README found" — a misleading message despite a README having been shown. Use explicit if/elif: @if [ -f README.adoc ]; then head -30 README.adoc; elif [ -f README.md ]; then head -30 README.md; else echo "No README found"; fi.

✅ 2 resolved

✅ Security: Root secret-scanner uses unpinned action refs

📄 .github/workflows/secret-scanner.yml:18-27
The newly added inline trufflehog job pins nothing: it uses actions/checkout@v4 and trufflesecurity/trufflehog@main, both mutable refs. Every sibling repo in this same PR (fogbinder, rescript-templater, etc.) pins these to a full commit SHA. A mutable @main ref on a third-party secret scanner is a supply-chain risk (a compromised or changed upstream tag executes with secrets: inherit context) and contradicts the standardization goal of this PR. Pin both to the same SHA used elsewhere, e.g. trufflesecurity/trufflehog@8a8ef8526528d8a4ff3e2c90be08e25ef8efbd9b # v3 and actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1.

✅ Quality: Root secret-scanner runs duplicate/overlapping scan jobs

📄 .github/workflows/secret-scanner.yml:12-26
This workflow now runs both the reusable scan job (hyperpolymath/standards secret-scanner-reusable) and a separate inline trufflehog job that duplicates the same TruffleHog scan. This doubles CI time and produces redundant findings. Drop the inline trufflehog job and rely on the pinned reusable workflow, or remove the reusable call if the inline job is intended to replace it.

🤖 Prompt for agents

Code Review: Adopts standardized CI workflows and secret scanning on TruffleHog, but the root secret-scanner job uses unpinned action refs, runs duplicate overlapping scans, and contains a broken shell operator precedence in the justfile.

1. 💡 Bug: Justfile llm-context recipe has broken && / || precedence
   Files: Justfile:54

   `test -f README.adoc && head -30 README.adoc || test -f README.md && head -30 README.md || echo "No README found"` chains left-to-right, so when README.adoc exists and prints, the shell still evaluates `&& head -30 README.md`, printing the .md too or (when absent) falling through to `|| echo "No README found"` — a misleading message despite a README having been shown. Use explicit if/elif: `@if [ -f README.adoc ]; then head -30 README.adoc; elif [ -f README.md ]; then head -30 README.md; else echo "No README found"; fi`.

Options

Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Compact

gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}