Add reusable weekly secret-scan workflow, shared by dotfiles and symphony

[mark-brannan]

Problem

dotfiles has no scheduled secret re-scan today. symphony's secret-scan.yml has one: trufflehog ships new detector signatures continuously, so a commit that scanned clean last month can be flagged this month against a detector that didn't exist when it was pushed. Push-triggered scanning alone never re-checks history — only what's new in that push. dotfiles is the higher-worry case (per-machine secrets, sops-managed, $HOME worktree) but currently has zero coverage for this failure mode.

Approach

Don't centralize execution — cross-repo scanning from one workflow needs a PAT with access to every repo, which is worse than what exists today. Instead, share the workflow definition via workflow_call, the same pattern symphony's prose-budget job already uses (pulls its engine from dotfiles-ref: claude/prose-budget). Define the gitleaks/trufflehog scan job once — in dotfiles, since that's the natural home for shared engines — and have both dotfiles and symphony call it.

Completion criteria

• A reusable secret-scan workflow exists (in dotfiles), callable via workflow_call.
• Both dotfiles and symphony call it on a weekly schedule, each scanning its own repo's history under its own permissions (no cross-repo token).
• symphony's existing secret-scan.yml schedule job is migrated to call the shared workflow rather than running its own copy of the logic.
• Verified: a scheduled run actually fires and completes green in both repos (not just that the YAML parses).

Context

Raised while scoping symphony issue #71 (ci-gate/secret-gate migration) — the weekly-schedule requirement in symphony's secret-scan.yml is what's keeping that workflow separate from validate.yml, and Mark's a bigger worry is dotfiles lacking the same coverage entirely.

🤖 Generated with Claude Code

[mark-brannan]

Update 2026-09-22 -- most of this landed, by a different route

Verified against the three completion criteria:

• A reusable secret-scan workflow exists -- yes, but in mark-brannan/.github/.github/workflows/secret-scan.yml, not in dotfiles as this issue proposed. That is the better home in hindsight: it sits with the other shared engines (ci-gate, prose-budget, claude-review).
• symphony calls it on a weekly schedule -- yes. symphony/.github/workflows/secret-scan.yml:111 is uses: mark-brannan/.github/.github/workflows/secret-scan.yml@main, with cron: "17 9 * * 1".
• dotfiles has weekly coverage -- yes, cron: "23 9 * * 1" -- but by running its own copy of the scan logic, not by calling the shared workflow. .github/workflows/secret-scan.yml here has no uses: of the shared engine.

So the coverage gap that prompted this issue (dotfiles never re-scanning history against new trufflehog detectors) is closed. What remains is the deduplication: migrating dotfiles' secret-scan.yml to call the shared .github workflow, so the two repos cannot drift.

Labelled ready on that residual. Worth a look at whether it is still worth doing -- that is a judgment call, not one I have closed.

[mark-brannan]

Checkpoint — this issue is already done on main, no PR needed

Picked this up from the stale local branch ci-secret-scan-shared (7 commits, never pushed). Its diff against origin/main turned out to be a no-op: main already carries this exact migration, merged independently while that branch sat unpushed.

All four completion criteria, verified against current origin/main:

1. Reusable workflow exists — mark-brannan/.github/.github/workflows/secret-scan.yml (workflow_call, gitleaks-config input).
2. Both repos call it weekly — dotfiles cron: "23 9 * * 1", symphony cron: "17 9 * * 1".
3. dotfiles' secret-scan.yml calls the shared workflow (uses: mark-brannan/.github/.github/workflows/secret-scan.yml@main) rather than running its own gitleaks/trufflehog jobs — landed in ci: fold gitleaks/trufflehog into shared secret-scan workflow #76 (2026-09-04) and refined in ci: run secret-scan on every push, outside ci-gate, like every other repo #259 (2026-09-17).
4. Scheduled runs fire and complete green in both repos — confirmed via gh run list --workflow=secret-scan.yml --event schedule: dotfiles green every Monday since 2026-08-24 (latest 2026-09-21), symphony the same.

The 2026-09-22 "residual work" comment above was stale by the time it posted — #259 had already landed the migration five days earlier.

Branch protection is already aligned too: the ruleset on main requires secret-scan / gitleaks and secret-scan / trufflehog (the composed reusable-workflow check names), not the bare gitleaks/trufflehog names the old direct-jobs version produced. ci-secret-scan-shared's own stale .mergify.yml (bare check names, from before #231 fanned dotfiles' CI into ci-gate) would have been a real regression had it landed as-is.

Recommendation: close #264 — nothing left to build. ci-secret-scan-shared (local branch, in another session's worktree) can be deleted; it has no unique content.

🤖 Generated with Claude Code

[mark-brannan]

Closing: the work is on main via #76 and #259, verified in the comment above (both repos call the shared weekly workflow, runs green since 2026-08-24). Orchestration session, 2026-09-22.