Repository navigation
Estate drift: unresolvable trufflehog action pin (@7ee2e0fd… # main) breaks quality/lint estate-wide #82
Description
Activity
- added a parent issue
on May 17, 2026 Closing as resolved by canonical-workflow migration.
Evidence:
- v3-templater
quality.ymlno longer usestrufflesecurity/trufflehogat all — migrated to Deno-based quality checks (deno lint/deno fmt/ TODO marker grep). Verified via Contents API onmain, sha556e76e. - reposystem no longer carries a
.github/workflows/quality.yml(404 from Contents API), so the canonical scaffolding source is clean. - verisimdb
quality.ymllikewise 404 — repo no longer has the file. - Active root-level
.github/workflows/secret-scanner.ymlworkflows in all consumer repos use the standards reusable (PR feat(governance): add secret-scanner-reusable.yml — propagate shell-secrets to 281 repos #190secret-scanner-reusable.yml— MERGED 2026-05-26, 281/281 sweep complete per [[session-2026-05-26-reusables-campaign]]). Verifiedmaa-framework/.github/workflows/secret-scanner.ymlandstapeln/.github/workflows/secret-scanner.ymlno longer reference trufflehog directly. - Bad SHA
7ee2e0fdffec27d19ccbb8fb3dcf8a83b9d7f9e8only persists in non-active vendored sub-paths (maa-framework/aletheia/.github/workflows/secret-scanner.yml,stapeln/container-stack/svalinn/.github/workflows/secret-scanner.yml) — those are inside nested project directories, not active workflows.gh api repos/{maa-framework,stapeln}/actions/workflowsconfirms only the root-level secret-scanner is wired.
Residual occurrences are all benign: 5 docs/scripts/historical references (CHANGELOG/SECURITY.md/audit-report) + 3 lookup tables in
hypatia/scripts/fix-*.shandscripts/fix-unpinned-actions.shwhich encode the bad-SHA as the source pattern that the auto-fix REWRITES. No active workflow consumes the bad SHA.- v3-templater
Sub-issue of #66 (2026-05-16 sweep findings — surfaced again 2026-05-17 via the burble#35 SARIF PRs).
Symptom
lint/qualityjob fails atSet up job(before any step runs):The step has
continue-on-error: true, but action resolution happens before the step, so the whole job goes red regardless. This is a hard estate-wide baseline red, not advisory.Root cause
quality.ymlpinstrufflesecurity/trufflehog@7ee2e0fdffec27d19ccbb8fb3dcf8a83b9d7f9e8 # main— i.e. a SHA captured from upstream's movingmainbranch. Upstream GC'd / rewrote it, so the SHA no longer resolves. Pinning@<sha> # mainis itself the anti-pattern: pin to a released tag SHA, never a moving ref's transient SHA.Canonical home + blast radius (confirmed local clones)
Canonical
quality.ymllives in reposystem and v3-templater. Bad SHA7ee2e0fd…confirmed in:v3-templater/.github/workflows/quality.yml:19(# main)repos/verisimdb/.github/workflows/quality.yml:69(# main)repos/ochrance/.github/workflows/secret-scanner.yml:22(# v3— mislabelled, same bad SHA)quality.yml/secret-scanner.yml)Fix
trufflesecurity/trufflehog@05cccb53bc9e13bc6d17997db5a6bcc3df44bf2f # v3.92.3(deterministic, preferred)…@6c05c4a00b91aa542267d8e32a8254774799d68d # v3reposystem+v3-templaterquality.yml, andsecret-scanner.ymlwhere the same mislabelled pin exists), then consumer sweep per the [drift playbook].@<sha> # main|master|HEADpins so this class can't recur (Explicit-Escape / truth-in-pinning).Refs #66