security: re-pin secret scanner onto the real gitleaks gate

[hyperpolymath]

This repo's Secret Scanner has been reporting success while being incapable of failing.

The caller pinned secret-scanner-reusable at @d135b05 (2026-06-24) — 64 commits behind standards#500. At that pin the step is literally:

- name: Gitleaks Secret Scan
  continue-on-error: true          # <- cannot fail
  uses: gitleaks/gitleaks-action@e0c47f4f...

Re-pinned to @c65436ee (contains #500 — compare reports ahead 5 / behind 0):

- name: Install gitleaks (pinned + checksum-verified)   # sha256-verified binary
- name: Gitleaks secret scan (gating)
  run: ... gitleaks detect ... --exit-code 1            # gates for real

Also narrowed the caller's grant to contents: read — the new reusable invokes a binary rather than gitleaks-action, so it no longer requests pull-requests: write / actions: read. (That mismatch is what startup_failured standards' own scanner; see standards#511.)

.gitleaks.toml added

Without it the now-real gate reds on false positives here. The file is byte-identical to the estate baseline in standards#512 — it allowlists by anchored pattern class (dependency-metadata hashes, whole-value placeholder shapes, published test vectors), never by file and never by disabling a rule, so a genuinely new secret in the same files still trips.

Verified before opening: gitleaks detect --exit-code 1 passes on this tree.

Part of the estate-wide sweep of ~200 repos still on the pre-#500 pin.

🤖 Generated with Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 231 issues detected

Severity	Count
🔴 Critical	15
🟠 High	138
🟡 Medium	78

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Action actions/checkout@v4 needs attention",
    "type": "unpinned_action",
    "file": "pages-deploy.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action actions/checkout@v4 needs attention",
    "type": "unpinned_action",
    "file": "pages.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action actions/checkout@v4 needs attention",
    "type": "unpinned_action",
    "file": "pages.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action actions/upload-pages-artifact@v3 needs attention",
    "type": "unpinned_action",
    "file": "pages.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action actions/deploy-pages@v4 needs attention",
    "type": "unpinned_action",
    "file": "pages.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in build.yml",
    "type": "missing_timeout_minutes",
    "file": "build.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in pages-deploy.yml",
    "type": "missing_timeout_minutes",
    "file": "pages-deploy.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in push-email-notify.yml",
    "type": "missing_timeout_minutes",
    "file": "push-email-notify.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in scorecard-enforcer.yml",
    "type": "missing_timeout_minutes",
    "file": "scorecard-enforcer.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in scorecard-enforcer.yml",
    "type": "scorecard_publish_with_run_step",
    "file": "scorecard-enforcer.yml",
    "action": "split_scorecard_publish_job",
    "rule_module": "workflow_audit",
    "severity": "high"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence