[roodboi]

Summary

Add secret scanning and commit email checks for PRs targeting hd/nightly and pushes to hd/nightly. The workflow uses read-only contents permission and anonymously fetches full history from the public fork. No checkout credentials are supplied or persisted. Direct Git checkout avoids recursive auth cleanup failing on vendored gitlinks without .gitmodules entries. It downloads gitleaks directly, verifies the pinned SHA-256 before extraction, and runs gitleaks git --redact --log-opts="-m <base..head>" without diagnostics. Merge diffs include additions made during conflict resolution. The scanner still runs when the email check fails.

PRs check both raw author and committer emails for every commit outside the base SHA. Pushes check first-parent commits; merge commits with non-allowlisted authors are exempt to allow upstream integration. This is an explicit metadata-policy exception, not verification of upstream provenance. Gitleaks scans the entire range, including side branches. Missing endpoints fail closed. The allowlist accepts GitHub noreply addresses and dimitrikennedy@gmail.com, confirmed in existing maintainer history. Rejected email values are not logged.

Pins and vet notes

• gitleaks v8.30.1, release tag commit 83d9cd684c87d95d656c1458ef04895a7f1cbd8e (confirmed with gh api), MIT. Official gitleaks_8.30.1_linux_x64.tar.gz SHA-256: 551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb. Downloaded archive matched. Supplied source-review vetting found no network calls during scans; diagnostics are never enabled. No gitleaks/gitleaks-action or organization license requirement.
• No third-party actions are used. Anonymous Git fetch replaces actions/checkout; token permissions remain limited to contents: read and no token is passed to Git.
• Local workflow validator: actionlint v1.7.7, official archive SHA-256 2693315b9093aeacb4ebd91a993fea54fc215057bf0da2659056b4bc033873db, verified against the release checksum file. Downloaded only into the ignored worktree directory; no system installation.

Validation

• Commit hygiene CI run passed on cda2c3203ad5b1a5c06ddd5dba707a9932fd1a66: anonymous checkout, email validation, verified Linux gitleaks download, both regression suites, and the actual range scan all succeeded.
• bash .github/scripts/check-commit-emails.test.sh: passed. Covers base exclusions, multiple commits, valid maintainer/noreply identities, invalid author and committer identities, domain suffix spoofing, upstream merge exceptions, PR versus push traversal, unavailable endpoints, and non-disclosure of rejected addresses.
• bash .github/scripts/commit-hygiene.test.sh <verified-gitleaks-path>: passed with gitleaks v8.30.1. An inert custom-rule marker introduced only in a merge is missed by the old invocation and detected by the actual scan script using -m. A malformed-gitlink fixture reproduces the old cleanup failure, verifies the anonymous full-history checkout, checks that no auth configuration is stored, and successfully runs both the email check and scanner. Both fixture suites run in CI.
• Email check and redacted gitleaks scan against this branch's actual origin/hd/nightly..HEAD: passed, two commits scanned with no leaks.
• actionlint v1.7.7: passed (ShellCheck integration disabled because ShellCheck is unavailable).
• Ruby YAML parse, Bash syntax checks, and staged git diff --check: passed.
• vp run check:changed origin/hd/nightly: attempted but unavailable (vp: command not found; dependencies are absent). No repository-wide checks were run. Local gitleaks execution used the matching v8.30.1 release archive verified against the official checksums; Linux execution is covered by CI.

No machine configuration was changed. This PR remains a draft and targets hd/nightly.

T3 threads: two review threads (links kept private).

Model: hd/gpt-6-astra. Harness: Codex in T3 Code.