From 3698e2a515782c689b9d9bac1784d90ce0d0b6f8 Mon Sep 17 00:00:00 2001
From: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com>
Date: Sat, 31 Oct 2026 18:00:38 +0000
Subject: [PATCH 1/2] ci: migrate secret scanner to bounded suite

Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>
---
 .github/workflows/actions.lock       | 10 +++++++++-
 .github/workflows/secret-scanner.yml |  8 +++++---
 2 files changed, 14 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock
index 1b0aa01..e63b4b0 100644
--- a/.github/workflows/actions.lock
+++ b/.github/workflows/actions.lock
@@ -38,7 +38,10 @@ workflows:
         - 'actions/checkout@v7.0.1'
     '.github/workflows/rust-ci.yml': []
     '.github/workflows/scorecard.yml': []
-    '.github/workflows/secret-scanner.yml': []
+    # Remote reusable checkout edge: gh actions-lock cannot discover job-level
+    # reusable calls; preserve this entry when regenerating the lock.
+    '.github/workflows/secret-scanner.yml':
+        - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
     '.github/workflows/static-analysis-gate.yml':
         - 'actions/checkout@v7.0.1'
         - 'actions/download-artifact@v8.0.2'
@@ -50,6 +53,11 @@ dependencies:
         commit: 'sha1-55cc8345863c7cc4c66a329aec7e433d2d1c52a9'
         owner_id: 44036562
         repo_id: 215566462
+    'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1':
+        ref: 'v7.0.1'
+        commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1'
+        owner_id: 44036562
+        repo_id: 197814629
     'actions/checkout@v7.0.1':
         ref: 'v7.0.1'
         commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1'
diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml
index a6a596c..2e99f4a 100644
--- a/.github/workflows/secret-scanner.yml
+++ b/.github/workflows/secret-scanner.yml
@@ -14,10 +14,12 @@ concurrency:
   cancel-in-progress: true
 
 permissions:
-  actions: read
   contents: read
 
 jobs:
   scan:
-    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a
-    secrets: inherit
+    # Keep this direct scan caller and its required scan / gitleaks context.
+    # The pinned reusable only needs contents: read and no inherited secrets.
+    uses: hyperpolymath/cicd-suite/.github/workflows/secret-scanner-reusable.yml@4404c3c0474e17753fe7689f3485c02890aac113
+    with:
+      fast-pr: false # Preserve full-history PR scanning.

From ed6b0102780a2fec80a09f7718339c5612d653fe Mon Sep 17 00:00:00 2001
From: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com>
Date: Sat, 31 Oct 2026 18:01:44 +0000
Subject: [PATCH 2/2] ci: keep lock annotations outside parsed lock

Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>
---
 .github/workflows/actions.lock       | 2 --
 .github/workflows/secret-scanner.yml | 2 ++
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock
index e63b4b0..e3e8827 100644
--- a/.github/workflows/actions.lock
+++ b/.github/workflows/actions.lock
@@ -38,8 +38,6 @@ workflows:
         - 'actions/checkout@v7.0.1'
     '.github/workflows/rust-ci.yml': []
     '.github/workflows/scorecard.yml': []
-    # Remote reusable checkout edge: gh actions-lock cannot discover job-level
-    # reusable calls; preserve this entry when regenerating the lock.
     '.github/workflows/secret-scanner.yml':
         - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
     '.github/workflows/static-analysis-gate.yml':
diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml
index 2e99f4a..80b9c5e 100644
--- a/.github/workflows/secret-scanner.yml
+++ b/.github/workflows/secret-scanner.yml
@@ -20,6 +20,8 @@ jobs:
   scan:
     # Keep this direct scan caller and its required scan / gitleaks context.
     # The pinned reusable only needs contents: read and no inherited secrets.
+    # Its checkout edge is explicit in actions.lock: gh actions-lock cannot
+    # discover remote job-level reusable calls, so retain it on regeneration.
     uses: hyperpolymath/cicd-suite/.github/workflows/secret-scanner-reusable.yml@4404c3c0474e17753fe7689f3485c02890aac113
     with:
       fast-pr: false # Preserve full-history PR scanning.