ci: canary-test the secret scanner, and actually run tests/

[hyperpolymath]

Phase 3 (preventive) of the secret-scanner programme. Two gaps, one shape.

1. The secret scanner had no canary

Every defect found in the 201-repo sweep was invisible in CI, because a gate that cannot fail is indistinguishable from a gate that passes:

Defect	Consequence
continue-on-error: true on gitleaks	scan found a live Cloudflare Global API Key in a PUBLIC repo and reported success anyway — for months, across ~200 repos
rust-secrets grepped ./src only	Cargo workspaces keep code in crates/*/src; grep exits 2 on a missing dir and the if read that as clean. 8 of 64 Rust repos (12.5%) never scanned at all
const.*KEY.*= missed static AUTH_KEY	found only because a canary planted 5 secrets and the job reported 4

tests/test_secret_scanner_canary.sh plants known secrets and asserts the scanner still trips — 9 assertions:

PASS  5 planted secrets in ./src -> BLOCKS
PASS  all 5 planted secrets reported (not just the first)
PASS  secret in crates/*/src -> BLOCKS after cutoff (no root ./src)
PASS  secret in crates/*/src -> advisory before cutoff
PASS  advisory run reports the finding and never claims a clean pass
PASS  env::var / URL / lookup / path / comment / pragma -> ALLOWED
PASS  literal secret + later env::var mention -> STILL BLOCKS
PASS  malformed cutoff -> REFUSES TO RUN
PASS  no Cargo.toml -> skips cleanly

Note assertion 2 counts findings rather than checking the exit code. The static AUTH_KEY defect passed an exit-code assertion — exit 1 only proves ≥1 was found, not that all were.

It extracts the step body from secret-scanner-reusable.yml at run time and executes it. Not a copy: a copy silently drifts from what ships, which is how these defects survived review.

Mutation tested

A canary that cannot fail would be the very thing it guards against. Reintroducing each historical defect kills it:

Mutant	Result
./src-only scan	✓ killed
drop static from the KEY pattern	✓ killed
make the job unable to fail	✓ killed
over-broad env::var exemption	✓ killed
disarm the date guard	✓ killed

5/5.

2. tests/ was wired into no workflow

tests/test_check_trusted_base.sh has existed for some time and never executed in CI — the same shape a third time: a test that never runs looks exactly like a test that passes.

self-test.yml runs every tests/*.sh, so adding a test is now sufficient to have it enforced. Fail-closed: empty discovery fails the job rather than reporting a vacuous pass.

Also: registry regeneration

7 stale source_hash entries accumulated from #522/#525 plus these new files.

⚠️ This is the fourth registry-drift repair today. The drift keeps reaching main because Registry + topology in sync is not a required status check, while a phantom Dependabot context forces --admin on every merge — which bypasses all protection including the check that correctly failed on the PR. That ruleset fix is owner-only and tracked separately; without it this repair will be needed again.

Verified

• both test files pass locally (2/2)
• canary 9/9 against the shipping reusable
• 5/5 mutants killed
• scripts/build-registry.sh --check exits 0

🤖 Generated with Claude Code

[sonarqubecloud]

Quality Gate failed

Failed conditions
C Security Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE