Skip to content

fix(ci): remove rust-ci.yml as repo has no Cargo.toml - #37

Merged
hyperpolymath merged 2 commits into
mainfrom
chore/remove-rust-ci-no-cargo
Sep 12, 2026
Merged

hyperpolymath merged 2 commits into
mainfrom
chore/remove-rust-ci-no-cargo

Conversation

@hyperpolymath

Copy link
Copy Markdown
Owner

Removing rust-ci.yml workflow since this repository has no Rust code (Cargo.toml not present). The reusable rust-ci-reusable.yml already guards itself by detecting Cargo.toml presence, but repos without Rust code shouldn't trigger unnecessary workflow runs.

Removing rust-ci.yml workflow since this repository has no Rust code
(Cargo.toml not present). The reusable rust-ci-reusable.yml already guards
itself by detecting Cargo.toml presence, but repos without Rust code
shouldn't trigger unnecessary workflow runs.

Generated by Mistral Vibe.
Co-Authored-By: Mistral Vibe <vibe@mistral.ai>
@coderabbitai

coderabbitai Bot commented Sep 11, 2026 •

Copy link
Copy Markdown

Review Change StackReview Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: b7ce8666-6886-4fcb-b66c-d0770de32ab0

📥 Commits

Reviewing files that changed from the base of the PR and between 12c9560 and a498665.

⛔ Files ignored due to path filters (1)
  • .github/workflows/actions.lock is excluded by !**/*.lock
📒 Files selected for processing (1)
  • .github/workflows/rust-ci.yml
💤 Files with no reviewable changes (1)
  • .github/workflows/rust-ci.yml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details
⏰ Context from checks skipped due to timeout. (3)
  • GitHub Check: Hypatia
  • GitHub Check: Deposit findings for gitbot-fleet
  • GitHub Check: scan / Hypatia Neurosymbolic Analysis
⚠️ CI failures not shown inline (12)

GitHub Actions: Workflow Security Linter / 0_lint-workflows.txt: fix(ci): remove rust-ci.yml as repo has no Cargo.toml

Conclusion: failure

View job details

##[group]Run echo "=== Checking Action Pinning ==="
 �[36;1mecho "=== Checking Action Pinning ==="�[0m
 �[36;1m# Find any uses: lines that don't have `@SHA` format�[0m
 �[36;1m# Pattern: uses: owner/repo@<40-char-hex>�[0m
 �[36;1munpinned=$(grep -rnE "^[[:space:]]+uses:" .github/workflows/ | \�[0m
 �[36;1m  grep -v "@[a-f0-9]\{40\}" | \�[0m
 �[36;1m  grep -v "uses: \./\|uses: docker://\|uses: actions/github-script" || true)�[0m
 �[36;1m�[0m
 �[36;1mif [ -n "$unpinned" ]; then�[0m
 �[36;1m  echo "ERROR: Found unpinned actions:"�[0m
 �[36;1m  echo "$unpinned"�[0m
 �[36;1m  echo ""�[0m
 �[36;1m  echo "Replace version tags with SHA pins, e.g.:"�[0m
 �[36;1m  echo "  uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6.0.1"�[0m
 �[36;1m  exit 1�[0m
 �[36;1mfi�[0m
 �[36;1mecho "All actions are SHA-pinned"�[0m
 shell: /usr/bin/bash -e {0}
 ##[endgroup]
 === Checking Action Pinning ===
 ERROR: Found unpinned actions:
 .github/workflows/release.yml:115:        uses: actions/upload-artifact@v7.0.1
 .github/workflows/release.yml:138:        uses: softprops/action-gh-release@v3.0.3
 .github/workflows/release.yml:159:        uses: actions/attest-build-provenance@v4.2.2
 .github/workflows/boj-build.yml:29:        uses: actions/checkout@v7.0.1
 .github/workflows/dependabot-automerge.yml:60:        uses: dependabot/fetch-metadata@v3.1.0
 .github/workflows/quality.yml:32:        uses: trufflesecurity/trufflehog@v3.97.4
 .github/workflows/quality.yml:46:        uses: editorconfig-checker/action-editorconfig-checker@v3.0.0
 .github/workflows/e2e.yml:49:        uses: actions/checkout@v7.0.1
 .github/workflows/codeql.yml:39:        uses: actions/checkout@v7.0.1
 .github/workflows/codeql.yml:41:        uses: github/codeql-action/init@v4.37.9
 .github/workflows/codeql.yml:46:        uses: github/codeql-action/analyze@v4.37.9
 .github/workflows/sonarqube.yml:29:        uses: actions/checkout@v7.0.1
 .github/workflows/sonarqube.yml:33:        uses: SonarSource/sonarqube-sca...

GitHub Actions: SonarQube / 0_SonarQube.txt: fix(ci): remove rust-ci.yml as repo has no Cargo.toml

Conclusion: failure

View job details

##[group]Run SonarSource/sonarqube-scan-action@v8.2.1
 with:
   projectBaseDir: .
   scannerVersion: 8.1.0.6389
   scannerBinariesUrl: https://binaries.sonarsource.com/Distribution/sonar-scanner-cli
   skipSignatureVerification: false
 env:
   SONAR_***REDACTED_SECRET_ASSIGNMENT***
 ##[warning]Running this GitHub Action without SONAR_TOKEN is not recommended
 Installing Sonar Scanner CLI 8.1.0.6389 for linux-x64...
 Downloading from: https://binaries.sonarsource.com/Distribution/sonar-scanner-cli/sonar-scanner-cli-8.1.0.6389-linux-x64.zip
 Downloading signature from: https://binaries.sonarsource.com/Distribution/sonar-scanner-cli/sonar-scanner-cli-8.1.0.6389-linux-x64.zip.asc
 Importing SonarSource public key from hkps://keyserver.ubuntu.com...
 [command]/usr/bin/gpg --homedir /home/runner/work/_temp/gpg-67808d93 --batch --keyserver hkps://keyserver.ubuntu.com --recv-keys 679F1EE92B19609DE816FDE81DB198F93525EC1A
 gpg: keybox '/home/runner/work/_temp/gpg-67808d93/pubring.kbx' created
 gpg: /home/runner/work/_temp/gpg-67808d93/trustdb.gpg: trustdb created
 gpg: key 1DB198F93525EC1A: public key "SonarSource S.A. <infra@sonarsource.com>" imported
 gpg: Total number processed: 1
 gpg:               imported: 1
 Successfully imported key from hkps://keyserver.ubuntu.com
 ✓ SonarSource public key imported successfully
 Verifying GPG signature...
 [command]/usr/bin/gpg --homedir /home/runner/work/_temp/gpg-67808d93 --batch --verify /home/runner/work/_temp/caeafbec-9811-453c-a664-8e2afad8d58d /home/runner/work/_temp/245bc76c-4673-4899-bd36-f775e28b38a0
 gpg: Signature made Tue Apr 21 07:20:26 2026 UTC
 gpg:                using RSA key D1436C0DBACEA48702AF97C363F1DD7753B8B315
 gpg: Good signature from "SonarSource S.A. <infra@sonarsource.com>" [unknown]
 gpg: WARNING: This key is not certified with a trusted signature!
 gpg:          There is no indication that the signature belongs to the owner.
 Primary key fingerprint: 679F 1EE9 2B19 609D E816  FDE8 1DB1 98F9 3525 EC1A...

GitHub Actions: Workflow Security Linter / lint-workflows: fix(ci): remove rust-ci.yml as repo has no Cargo.toml

Conclusion: failure

View job details

##[group]Run echo "=== Checking Action Pinning ==="
 �[36;1mecho "=== Checking Action Pinning ==="�[0m
 �[36;1m# Find any uses: lines that don't have `@SHA` format�[0m
 �[36;1m# Pattern: uses: owner/repo@<40-char-hex>�[0m
 �[36;1munpinned=$(grep -rnE "^[[:space:]]+uses:" .github/workflows/ | \�[0m
 �[36;1m  grep -v "@[a-f0-9]\{40\}" | \�[0m
 �[36;1m  grep -v "uses: \./\|uses: docker://\|uses: actions/github-script" || true)�[0m
 �[36;1m�[0m
 �[36;1mif [ -n "$unpinned" ]; then�[0m
 �[36;1m  echo "ERROR: Found unpinned actions:"�[0m
 �[36;1m  echo "$unpinned"�[0m
 �[36;1m  echo ""�[0m
 �[36;1m  echo "Replace version tags with SHA pins, e.g.:"�[0m
 �[36;1m  echo "  uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6.0.1"�[0m
 �[36;1m  exit 1�[0m
 �[36;1mfi�[0m
 �[36;1mecho "All actions are SHA-pinned"�[0m
 shell: /usr/bin/bash -e {0}
 ##[endgroup]
 === Checking Action Pinning ===
 ERROR: Found unpinned actions:
 .github/workflows/release.yml:115:        uses: actions/upload-artifact@v7.0.1
 .github/workflows/release.yml:138:        uses: softprops/action-gh-release@v3.0.3
 .github/workflows/release.yml:159:        uses: actions/attest-build-provenance@v4.2.2
 .github/workflows/boj-build.yml:29:        uses: actions/checkout@v7.0.1
 .github/workflows/dependabot-automerge.yml:60:        uses: dependabot/fetch-metadata@v3.1.0
 .github/workflows/quality.yml:32:        uses: trufflesecurity/trufflehog@v3.97.4
 .github/workflows/quality.yml:46:        uses: editorconfig-checker/action-editorconfig-checker@v3.0.0
 .github/workflows/e2e.yml:49:        uses: actions/checkout@v7.0.1
 .github/workflows/codeql.yml:39:        uses: actions/checkout@v7.0.1
 .github/workflows/codeql.yml:41:        uses: github/codeql-action/init@v4.37.9
 .github/workflows/codeql.yml:46:        uses: github/codeql-action/analyze@v4.37.9
 .github/workflows/sonarqube.yml:29:        uses: actions/checkout@v7.0.1
 .github/workflows/sonarqube.yml:33:        uses: SonarSource/sonarqube-sca...

GitHub Actions: Estate Rules / 0_estate-rules.txt: fix(ci): remove rust-ci.yml as repo has no Cargo.toml

Conclusion: failure

View job details

##[group]Run bash scripts/check-root-shape.sh .
 �[36;1mbash scripts/check-root-shape.sh .�[0m
 shell: /usr/bin/bash -e {0}
 ##[endgroup]
 FAIL: 3 root entries are not on the allowlist:
   - CHANGELOG.adoc
   - CONTRIBUTING.adoc
   - SECURITY.adoc
 Either move them into the appropriate subdirectory, or add a justified
 entry to .machine_readable/root-allow.txt.
 ##[error]Process completed with exit code 1.

GitHub Actions: SonarQube / SonarQube: fix(ci): remove rust-ci.yml as repo has no Cargo.toml

Conclusion: failure

View job details

##[group]Run SonarSource/sonarqube-scan-action@v8.2.1
 with:
   projectBaseDir: .
   scannerVersion: 8.1.0.6389
   scannerBinariesUrl: https://binaries.sonarsource.com/Distribution/sonar-scanner-cli
   skipSignatureVerification: false
 env:
   SONAR_***REDACTED_SECRET_ASSIGNMENT***
 ##[warning]Running this GitHub Action without SONAR_TOKEN is not recommended
 Installing Sonar Scanner CLI 8.1.0.6389 for linux-x64...
 Downloading from: https://binaries.sonarsource.com/Distribution/sonar-scanner-cli/sonar-scanner-cli-8.1.0.6389-linux-x64.zip
 Downloading signature from: https://binaries.sonarsource.com/Distribution/sonar-scanner-cli/sonar-scanner-cli-8.1.0.6389-linux-x64.zip.asc
 Importing SonarSource public key from hkps://keyserver.ubuntu.com...
 [command]/usr/bin/gpg --homedir /home/runner/work/_temp/gpg-67808d93 --batch --keyserver hkps://keyserver.ubuntu.com --recv-keys 679F1EE92B19609DE816FDE81DB198F93525EC1A
 gpg: keybox '/home/runner/work/_temp/gpg-67808d93/pubring.kbx' created
 gpg: /home/runner/work/_temp/gpg-67808d93/trustdb.gpg: trustdb created
 gpg: key 1DB198F93525EC1A: public key "SonarSource S.A. <infra@sonarsource.com>" imported
 gpg: Total number processed: 1
 gpg:               imported: 1
 Successfully imported key from hkps://keyserver.ubuntu.com
 ✓ SonarSource public key imported successfully
 Verifying GPG signature...
 [command]/usr/bin/gpg --homedir /home/runner/work/_temp/gpg-67808d93 --batch --verify /home/runner/work/_temp/caeafbec-9811-453c-a664-8e2afad8d58d /home/runner/work/_temp/245bc76c-4673-4899-bd36-f775e28b38a0
 gpg: Signature made Tue Apr 21 07:20:26 2026 UTC
 gpg:                using RSA key D1436C0DBACEA48702AF97C363F1DD7753B8B315
 gpg: Good signature from "SonarSource S.A. <infra@sonarsource.com>" [unknown]
 gpg: WARNING: This key is not certified with a trusted signature!
 gpg:          There is no indication that the signature belongs to the owner.
 Primary key fingerprint: 679F 1EE9 2B19 609D E816  FDE8 1DB1 98F9 3525 EC1A...

GitHub Actions: Estate Rules / estate-rules: fix(ci): remove rust-ci.yml as repo has no Cargo.toml

Conclusion: failure

View job details

##[group]Run bash scripts/check-root-shape.sh .
 �[36;1mbash scripts/check-root-shape.sh .�[0m
 shell: /usr/bin/bash -e {0}
 ##[endgroup]
 FAIL: 3 root entries are not on the allowlist:
   - CHANGELOG.adoc
   - CONTRIBUTING.adoc
   - SECURITY.adoc
 Either move them into the appropriate subdirectory, or add a justified
 entry to .machine_readable/root-allow.txt.
 ##[error]Process completed with exit code 1.

GitHub Actions: Secret Scanner / 0_scan _ gitleaks.txt: fix(ci): remove rust-ci.yml as repo has no Cargo.toml

Conclusion: failure

View job details

##[group]Run set -euo pipefail
 �[36;1mset -euo pipefail�[0m
 �[36;1m�[0m
 �[36;1m# A repo-local baseline wins outright — it is expected to `[extend]`�[0m
 �[36;1m# the estate one, so "wins" still means "inherits". This mirrors what�[0m
 �[36;1m# the AsciiDoc pass below already did, which was inconsistent with�[0m
 �[36;1m# this step until now.�[0m
 �[36;1mCONFIG=".gitleaks-estate.toml"�[0m
 �[36;1mif [ -f .gitleaks.toml ]; then�[0m
 �[36;1m  CONFIG=".gitleaks.toml"�[0m
 �[36;1m  echo "Using repository .gitleaks.toml (extending the estate baseline)."�[0m
 �[36;1melse�[0m
 �[36;1m  echo "Using estate baseline allowlist."�[0m
 �[36;1mfi�[0m
 �[36;1m�[0m
 �[36;1m"$RUNNER_TEMP/gitleaks" detect \�[0m
 �[36;1m  --source . \�[0m
 �[36;1m  --no-git \�[0m
 �[36;1m  --redact \�[0m
 �[36;1m  --no-banner \�[0m
 �[36;1m  --verbose \�[0m
 �[36;1m  --config "$CONFIG" \�[0m
 �[36;1m  --exit-code 1�[0m
 shell: /usr/bin/bash -e {0}
 ##[endgroup]
 Using estate baseline allowlist.
 Finding:     #     januskey -> �[1;3;mREDACTED�[0m
 #
 ***REDACTED_SECRET_ASSIGNMENT***
 RuleID:      generic-api-key
 Entropy:     3.840083
 File:        .machine_readable/descriptiles/CLADE.a2ml
 Line:        21
 Fingerprint: .machine_readable/descriptiles/CLADE.a2ml:generic-api-key:21
 Finding:     const key = "�[1;3;mREDACTED�[0m"
 ***REDACTED_SECRET_ASSIGNMENT***
 RuleID:      generic-api-key
 Entropy:     4.168296
 File:        api/src/integration_tests.zig
 Line:        185
 Fingerprint: api/src/integration_tests.zig:generic-api-key:185
 Finding:     const key = "�[1;3;mREDACTED�[0m"
 ***REDACTED_SECRET_ASSIGNMENT***
 RuleID:      generic-api-key
 Entropy:     4.168296
 File:        api/src/websocket.zig
 Line:        306
 Fingerprint: api/src/websocket.zig:generic-api-key:306
 �[90m9:03AM�[0m �[32mINF�[0m scan completed in 374ms
 �[90m9:03AM�[0m �[31mWRN�[0m leaks found: 3
 ##[error]Process completed with exit code 1.

GitHub Actions: Secret Scanner / scan _ gitleaks: fix(ci): remove rust-ci.yml as repo has no Cargo.toml

Conclusion: failure

View job details

##[group]Run set -euo pipefail
 �[36;1mset -euo pipefail�[0m
 �[36;1m�[0m
 �[36;1m# A repo-local baseline wins outright — it is expected to `[extend]`�[0m
 �[36;1m# the estate one, so "wins" still means "inherits". This mirrors what�[0m
 �[36;1m# the AsciiDoc pass below already did, which was inconsistent with�[0m
 �[36;1m# this step until now.�[0m
 �[36;1mCONFIG=".gitleaks-estate.toml"�[0m
 �[36;1mif [ -f .gitleaks.toml ]; then�[0m
 �[36;1m  CONFIG=".gitleaks.toml"�[0m
 �[36;1m  echo "Using repository .gitleaks.toml (extending the estate baseline)."�[0m
 �[36;1melse�[0m
 �[36;1m  echo "Using estate baseline allowlist."�[0m
 �[36;1mfi�[0m
 �[36;1m�[0m
 �[36;1m"$RUNNER_TEMP/gitleaks" detect \�[0m
 �[36;1m  --source . \�[0m
 �[36;1m  --no-git \�[0m
 �[36;1m  --redact \�[0m
 �[36;1m  --no-banner \�[0m
 �[36;1m  --verbose \�[0m
 �[36;1m  --config "$CONFIG" \�[0m
 �[36;1m  --exit-code 1�[0m
 shell: /usr/bin/bash -e {0}
 ##[endgroup]
 Using estate baseline allowlist.
 Finding:     #     januskey -> �[1;3;mREDACTED�[0m
 #
 ***REDACTED_SECRET_ASSIGNMENT***
 RuleID:      generic-api-key
 Entropy:     3.840083
 File:        .machine_readable/descriptiles/CLADE.a2ml
 Line:        21
 Fingerprint: .machine_readable/descriptiles/CLADE.a2ml:generic-api-key:21
 Finding:     const key = "�[1;3;mREDACTED�[0m"
 ***REDACTED_SECRET_ASSIGNMENT***
 RuleID:      generic-api-key
 Entropy:     4.168296
 File:        api/src/integration_tests.zig
 Line:        185
 Fingerprint: api/src/integration_tests.zig:generic-api-key:185
 Finding:     const key = "�[1;3;mREDACTED�[0m"
 ***REDACTED_SECRET_ASSIGNMENT***
 RuleID:      generic-api-key
 Entropy:     4.168296
 File:        api/src/websocket.zig
 Line:        306
 Fingerprint: api/src/websocket.zig:generic-api-key:306
 �[90m9:03AM�[0m �[32mINF�[0m scan completed in 374ms
 �[90m9:03AM�[0m �[31mWRN�[0m leaks found: 3
 ##[error]Process completed with exit code 1.

GitHub Actions: Secret Scanner / 1_scan _ rust-secrets.txt: fix(ci): remove rust-ci.yml as repo has no Cargo.toml

Conclusion: failure

View job details

##[group]Run TODAY="${RUST_TODAY:-$(date -u +%Y-%m-%d)}"
 �[36;1mTODAY="${RUST_TODAY:-$(date -u +%Y-%m-%d)}"�[0m
 �[36;1m�[0m
 �[36;1m# An unparseable cutoff would pick the warn branch forever, silently�[0m
 �[36;1m# disarming the widened scan. Refuse to run instead.�[0m
 �[36;1mrequire_date() {�[0m
 �[36;1m  case "$2" in�[0m
 �[36;1m    [0-9][0-9][0-9][0-9]-[0-1][0-9]-[0-3][0-9]) : ;;�[0m
 �[36;1m    *) echo "::error::rust-secrets: $1='$2' is not YYYY-MM-DD."�[0m

GitHub Actions: Secret Scanner / scan _ rust-secrets: fix(ci): remove rust-ci.yml as repo has no Cargo.toml

Conclusion: failure

View job details

##[group]Run TODAY="${RUST_TODAY:-$(date -u +%Y-%m-%d)}"
 �[36;1mTODAY="${RUST_TODAY:-$(date -u +%Y-%m-%d)}"�[0m
 �[36;1m�[0m
 �[36;1m# An unparseable cutoff would pick the warn branch forever, silently�[0m
 �[36;1m# disarming the widened scan. Refuse to run instead.�[0m
 �[36;1mrequire_date() {�[0m
 �[36;1m  case "$2" in�[0m
 �[36;1m    [0-9][0-9][0-9][0-9]-[0-1][0-9]-[0-3][0-9]) : ;;�[0m
 �[36;1m    *) echo "::error::rust-secrets: $1='$2' is not YYYY-MM-DD."�[0m

GitHub Actions: Secret Scanner / 2_scan _ shell-secrets.txt: fix(ci): remove rust-ci.yml as repo has no Cargo.toml

Conclusion: failure

View job details

##[group]Run # Patterns: an `export FOO=` or `FOO=` with a quoted literal of meaningful length.
 �[36;1m# Patterns: an `export FOO=` or `FOO=` with a quoted literal of meaningful length.�[0m
 �[36;1m# Restricted to *_TOKEN / *_KEY / *_SECRET / PASSWORD to keep false-positives low.�[0m
 �[36;1mPATTERNS=(�[0m
 �[36;1m  '(export[[:space:]]+)?[A-Z_]*TOKEN[A-Z_]*=["'"'"'][A-Za-z0-9_./+=-]{20,}["'"'"']'�[0m
 �[36;1m  '(export[[:space:]]+)?[A-Z_]*API_KEY[A-Z_]*=["'"'"'][A-Za-z0-9_./+=-]{20,}["'"'"']'�[0m
 �[36;1m  '(export[[:space:]]+)?[A-Z_]*SECRET[A-Z_]*=["'"'"'][A-Za-z0-9_./+=-]{16,}["'"'"']'�[0m
 �[36;1m  '(export[[:space:]]+)?***"'"'"'][^"'"'"']{6,}["'"'"']'�[0m
 �[36;1m)�[0m
 �[36;1m�[0m
 �[36;1m# Inline pragma patterns — suppress a hit when found on the same or�[0m
 �[36;1m# immediately preceding line.�[0m
 �[36;1mPRAGMA_RE='(scanner-allow:[[:space:]]*shell-secrets|hypatia:[[:space:]]*allow[[:space:]]+security_errors/secret_detected)'�[0m
 �[36;1m�[0m
 �[36;1m# Param-expansion RHS pattern — assignments whose value is a variable�[0m
 �[36;1m# reference rather than a literal are never real secrets.�[0m
 �[36;1m# Matches: ="$VAR"  ="${VAR}"  ="${VAR:-…}"  ="${VAR:?…}"  ='${VAR}'  =$VAR�[0m
 �[36;1mPARAM_EXPANSION_RE='=['"'"'"'"'"']?\$\{?[A-Za-z_][A-Za-z0-9_]*(:[?-][^}]*)?\}?['"'"'"'"'"']?[[:space:]]*(#.*)?$'�[0m
 �[36;1m�[0m
 �[36;1m# Load per-repo ignore globs from .shell-secrets-ignore if present.�[0m
 �[36;1mIGNORE_GLOBS=()�[0m
 �[36;1mif [[ -f .shell-secrets-ignore ]]; then�[0m
 �[36;1m  while IFS= read -r line || [[ -n "$line" ]]; do�[0m
 �[36;1m    # Skip blank lines and comments�[0m
 �[36;1m    [[ -z "$line" || "$line" == \#* ]] && continue�[0m
 �[36;1m    IGNORE_GLOBS+=("$line")�[0m
 �[36;1m  done < .shell-secrets-ignore�[0m
 �[36;1mfi�[0m
 �[36;1m�[0m
 �[36;1m# is_ignored <filepath> — returns 0 (true) if path matches any ignore glob.�[0m
 �[36;1mis_ignored() {�[0m
 �[36;1m  local path="$1"�[0m
 �[36;1m  for glob in "${IGNORE_GLOBS[@]}"; do�[0m
 �[36;1m    #...

GitHub Actions: Secret Scanner / scan _ shell-secrets: fix(ci): remove rust-ci.yml as repo has no Cargo.toml

Conclusion: failure

View job details

##[group]Run # Patterns: an `export FOO=` or `FOO=` with a quoted literal of meaningful length.
 �[36;1m# Patterns: an `export FOO=` or `FOO=` with a quoted literal of meaningful length.�[0m
 �[36;1m# Restricted to *_TOKEN / *_KEY / *_SECRET / PASSWORD to keep false-positives low.�[0m
 �[36;1mPATTERNS=(�[0m
 �[36;1m  '(export[[:space:]]+)?[A-Z_]*TOKEN[A-Z_]*=["'"'"'][A-Za-z0-9_./+=-]{20,}["'"'"']'�[0m
 �[36;1m  '(export[[:space:]]+)?[A-Z_]*API_KEY[A-Z_]*=["'"'"'][A-Za-z0-9_./+=-]{20,}["'"'"']'�[0m
 �[36;1m  '(export[[:space:]]+)?[A-Z_]*SECRET[A-Z_]*=["'"'"'][A-Za-z0-9_./+=-]{16,}["'"'"']'�[0m
 �[36;1m  '(export[[:space:]]+)?***"'"'"'][^"'"'"']{6,}["'"'"']'�[0m
 �[36;1m)�[0m
 �[36;1m�[0m
 �[36;1m# Inline pragma patterns — suppress a hit when found on the same or�[0m
 �[36;1m# immediately preceding line.�[0m
 �[36;1mPRAGMA_RE='(scanner-allow:[[:space:]]*shell-secrets|hypatia:[[:space:]]*allow[[:space:]]+security_errors/secret_detected)'�[0m
 �[36;1m�[0m
 �[36;1m# Param-expansion RHS pattern — assignments whose value is a variable�[0m
 �[36;1m# reference rather than a literal are never real secrets.�[0m
 �[36;1m# Matches: ="$VAR"  ="${VAR}"  ="${VAR:-…}"  ="${VAR:?…}"  ='${VAR}'  =$VAR�[0m
 �[36;1mPARAM_EXPANSION_RE='=['"'"'"'"'"']?\$\{?[A-Za-z_][A-Za-z0-9_]*(:[?-][^}]*)?\}?['"'"'"'"'"']?[[:space:]]*(#.*)?$'�[0m
 �[36;1m�[0m
 �[36;1m# Load per-repo ignore globs from .shell-secrets-ignore if present.�[0m
 �[36;1mIGNORE_GLOBS=()�[0m
 �[36;1mif [[ -f .shell-secrets-ignore ]]; then�[0m
 �[36;1m  while IFS= read -r line || [[ -n "$line" ]]; do�[0m
 �[36;1m    # Skip blank lines and comments�[0m
 �[36;1m    [[ -z "$line" || "$line" == \#* ]] && continue�[0m
 �[36;1m    IGNORE_GLOBS+=("$line")�[0m
 �[36;1m  done < .shell-secrets-ignore�[0m
 �[36;1mfi�[0m
 �[36;1m�[0m
 �[36;1m# is_ignored <filepath> — returns 0 (true) if path matches any ignore glob.�[0m
 �[36;1mis_ignored() {�[0m
 �[36;1m  local path="$1"�[0m
 �[36;1m  for glob in "${IGNORE_GLOBS[@]}"; do�[0m
 �[36;1m    #...

📝 Summary

Summary by CodeRabbit

  • Chores
    • Removed the Rust continuous integration workflow from the project.

Walkthrough

The pull request deletes the Rust CI workflow. This removes its triggers, concurrency settings, permissions, and reusable workflow job.

Changes

Rust CI workflow removal

Layer / File(s) Summary
Remove Rust CI workflow
.github/workflows/rust-ci.yml
The Rust CI workflow, its triggers, concurrency settings, permissions, and reusable workflow job were deleted.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~2 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to 13636

Removing the unused Rust CI workflow does not introduce an evidenced runtime or integration risk.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Description check ⚠️ Warning The description explains the purpose of the change, but it does not use the required sections or provide the requested changes list, checklist status, testing details, or screenshots information. Update the description to include the Summary, Changes, RSR Quality Checklist, Testing, and Screenshots sections. State which checklist items apply and provide the commands or results used to validate the workflow removal.
✅ Passed checks (4 passed)
Check name Status Explanation
Title check ✅ Passed The title clearly states that the Rust CI workflow was removed because the repository has no Rust code or Cargo.toml.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches 💡 1
🛠️ Fix failing CI checks 💡
  • Create stacked PR
  • Commit on current branch

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

A rabbit watched the workflow fade,
Its triggers and job were laid.
The YAML path is clear and still,
No Rust CI runs at will.
Soft paws approve the tidy trade.

Comment @coderabbitai help to get the list of available commands.

@hyperpolymath
hyperpolymath merged commit c9cb517 into main Sep 12, 2026
16 of 23 checks passed
@hyperpolymath
hyperpolymath deleted the chore/remove-rust-ci-no-cargo branch September 12, 2026 17:24
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant