Repository navigation
ci: drop secrets: inherit from the secret scanner - #43
Conversation
The secret-scanner reusable (standards@75bd5994) declares no secrets and reads none; its gitleaks is a pinned local binary. The 'secrets: inherit is REQUIRED' header predates that and forwarded every repository secret for nothing. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MF5GeeBBDF6sUzr6pZTjWV
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info
📜 Recent review details
📝 Summary
Merge Risk: ⚪ Minimal · up to
|
| Check name | Status | Explanation |
|---|---|---|
| Title check |  |
The title clearly identifies the main change: removing secrets: inherit from the secret scanner workflow. |
| Description check | |
The description directly explains the removal of secrets: inherit, the updated comment, the scanner configuration, and the reported checks. |
| Docstring Coverage | |
No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0… |
| Linked Issues check | |
Check skipped because no linked issues were found for this pull request. |
| Out of Scope Changes check | |
Check skipped because no linked issues were found for this pull request. |
Full details: Docstring Coverage
-
Explanation
No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Comment @coderabbitai help to get the list of available commands.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
2 participants
Summary
secret-scanner.ymlforwards every repository secret to the reusable scanner withsecrets: inherit. The reusable (standards@75bd5994) declares noworkflow_callsecrets and reads none: its gitleaks is a pinned local binary, and theGITHUB_TOKENits jobs run under is governed bypermissions:. The header claiminginheritwas REQUIRED described an older gitleaks action that is gone. Raised by CodeRabbit on #42 (already merged) and verified against the callee.Changes
.github/workflows/secret-scanner.yml: removesecrets: inheritand replace the stale "REQUIRED" comment with the reason it is absent. Nothing else changes; theuses:pin andactions.lockare untouched.Testing
The file parses and
check-lock-sync.shpasses. The real test is thescanjobs still passing on this PR; choreographic-types already runs the same scanner with nosecrets:line.Generated by Claude Code