ci: standardize incremental secret scanning INF-163

[dongchenxie]

Summary

• scan every pull request and every branch push
• remove the manual full-history entry point from the INF-163 caller
• pin the reusable workflow and shared rules to the immutable INF-162 merge commit
• restrict caller permissions to read-only repository contents

Validation

• git diff --check
• the PR-triggered reusable scan is expected to validate this caller on GitHub

Linear: https://linear.app/treasurenet/issue/INF-163/roll-out-incremental-secret-scanning-to-priority-tn-repositories

Summary by CodeRabbit

• Chores
  • Improved automated secret scanning for pull requests and code pushes.
  • Restricted workflow permissions to read-only repository content.
  • Pinned the scanning workflow to a specific version for more consistent results.
• Documentation
  • Updated the incremental secret scanning “caller” workflow example in the README.
  • Added an INF-163 rollout guide for enabling and validating incremental secret scanning across eligible repositories.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 8acd206a-2062-4a31-99f0-6bee0438b2b8

📥 Commits

Reviewing files that changed from the base of the PR and between 3140e07 and f54fe64.

📒 Files selected for processing (2)

• README.md
• docs/security/inf-163-incremental-secret-scanning-rollout.md

---

📝 Walkthrough

Walkthrough

The secrets-scanning workflow now targets pull requests and pushes, uses read-only contents permissions, and invokes a pinned reusable workflow with pr or push scan modes. The README and rollout documentation describe organization-wide deployment, activation, validation, and remediation.

Changes

Incremental secret scanning rollout

Layer / File(s)	Summary
Configure incremental secret scanning .github/workflows/secrets-scanning.yml	Renames the workflow, simplifies triggers, adds contents: read permissions, pins the reusable workflow and configuration reference, and maps events to pr or push scan modes.
Document the organization caller README.md	Replaces the minimal caller example and updates guidance for incremental ranges, ruleset activation, optional Slack notifications, remediation, and false positives.
Define INF-163 rollout and response docs/security/inf-163-incremental-secret-scanning-rollout.md	Adds rollout scope, protection layers, validation evidence, repository manifests and exceptions, activation steps, failure response guidance, and INF-163/INF-164 responsibility boundaries.

Estimated code review effort: 2 (Simple) | ~15 minutes

Possibly related PRs

• treasurenetprotocol/reusable-workflows#63: Defines the reusable secrets-scanning workflow inputs and behavior used by this caller.

Suggested reviewers: chriszhao1988, shahar-w

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly reflects the main change: standardizing incremental secret scanning for INF-163.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch ci/incremental-secret-scanning-INF-163

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}