Scope CI secret-scan history to what the run would land

.github/workflows/validate.yml

@@ -142,7 +142,11 @@ jobs:
           # --config: reviewed allowlists (.gitleaks.toml); --max-target-megabytes 2: the
           # generated explorer HTML is skipped (recorded as incomplete coverage in
           # docs/github-automation.md); measured 2026-09-22: 522 commits, 777 MB, 34 s locally.
+          # --log-opts=HEAD: scan what this run would land (a pull request's merge commit, or
+          # main on push). The default is every fetched ref, so one open branch's finding
+          # failed every other pull request (2026-09-23: #116's branch failed #117).
           "$RUNNER_TEMP/gitleaks/gitleaks" git . --config .gitleaks.toml --max-target-megabytes 2 \
+            --log-opts="HEAD" \
             --redact --no-banner --report-format json --report-path "$RUNNER_TEMP/gitleaks/gitleaks.json"
       - name: Scan working tree for secrets
         if: always()

.gitleaks.toml

@@ -106,6 +106,11 @@
 # and reaching 0 on the default (all-refs) command may still require either
 # `--log-opts="HEAD"` or another branch's own fix -- unchanged from before,
 # and still a coordinator decision, not resolved by this unit.
+# Resolved 2026-09-23 by the coordinator: CI's secret-scan job now passes
+# --log-opts="HEAD", scanning the ancestry of what the run would land (a pull
+# request's merge commit, or main on push). The all-refs default had let
+# open PR #116's branch fail PR #117's required check; each branch is still
+# scanned by its own pull request's run.
 #
 # Before the whole-line-anchoring fix above, the same `--log-opts="HEAD"` command
 # (anchored to a single line only, pre-fix) additionally flagged two corpus_files

docs/github-automation.md

@@ -331,7 +331,12 @@ against `blueprints/convergence-practice/wsl-native-tools/pins.json`,
 `components[name=gitleaks].archive.sha256`,
 `551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb`) in `git`
 mode (full history, `fetch-depth: 0`) and `dir` mode (working tree), both
-`--redact`. The redacted JSON report is uploaded with `if: always()` so a
+`--redact`. Since 2026-09-23 the `git` mode passes `--log-opts="HEAD"`, so it
+scans the history of what the run would land: a pull request's merge commit,
+or `main` on push. gitleaks' default scans every fetched ref, and with
+`fetch-depth: 0` that includes every other open branch, so one branch's
+finding failed every pull request (PR #116's branch failed PR #117). Each
+branch is still scanned by its own pull request's run. The redacted JSON report is uploaded with `if: always()` so a
 failed scan still leaves the report retrievable; it never prints a matched
 secret to the job log. Unlike `sbom-vuln` below, this job fails on any
 detection (no `--exit-code` override, so gitleaks' non-zero default stands)
@@ -613,7 +618,8 @@ unrestricted default-log-opts scan of this shared, concurrently used repository
 currently reports one residual finding attributable to a different, active
 sibling branch (not an ancestor of this branch and not a path this unit owns),
 which the `.gitleaks.toml` header records as a coordinator decision pending
-resolution before merge, not something this unit can fix. Local scans on this
+resolution before merge, not something this unit can fix. The coordinator resolved it on 2026-09-23 by
+making CI scan only `--log-opts="HEAD"` (see above). Local scans on this
 host go through the guarded `gitleaks` launcher (memory-capped, one scan per
 user); do not raise its limits to retry a failed scan.
 

manifests/evidence.json

@@ -3068,8 +3068,8 @@
     },
     {
       "path": ".github/workflows/validate.yml",
-      "sha256": "4e391eabbddabc78f0633f124a54c9334ba4769b3af1efc124c1b04a6ed12e92",
-      "bytes": 8415
+      "sha256": "f46572f4e6e9bd058fa800a211c4703c0f109ee76434ec86615bb9a226f096ad",
+      "bytes": 8716
     },
     {
       "path": ".gitignore",
@@ -3078,8 +3078,8 @@
     },
     {
       "path": ".gitleaks.toml",
-      "sha256": "992903854d0ccd3fac56efe3e75c1b25b8e6cf2443191adb40ccd283b0ac84fc",
-      "bytes": 22666
+      "sha256": "9e0519773005b847ebc9fa1e8935765e93b74259fd7c8a4f15a4721cb7271107",
+      "bytes": 23008
     },
     {
       "path": ".gitleaksignore",
@@ -8789,8 +8789,8 @@
     },
     {
       "path": "docs/github-automation.md",
-      "sha256": "08d203319ab4e8e56905b5b6d29a16ef5799d9cdbd328b89f50d865cefdb70db",
-      "bytes": 62715
+      "sha256": "0291d8ebdb209f293896bae915ca74a25ae024c6d239a6d5cd90a3cac009f5fc",
+      "bytes": 63228
     },
     {
       "path": "docs/grand-catalog-handbook.md",