docs(scan): say what the weekly scan actually catches - #34
Conversation
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
![slopzapper[bot]](https://avatars.githubusercontent.com/in/4527847?s=60&v=4){kind=small}
There was a problem hiding this comment.
🟡 Changes recommended
The updated comment doesn’t fully match the PR description’s stated goal (explicitly calling out gitleaks/actionlint as offline repeats), so the documentation intent is not yet consistently reflected.
Get a fresh assessment by requesting another Copilot review.
Pull request overview
Updates the documentation comment in the Scan GitHub Actions workflow to more accurately describe why the weekly scheduled scan is valuable in this repository’s security posture.
Changes:
- Rewrites the top-of-file workflow comment to attribute the weekly schedule to scanners that consult live state (TruffleHog verification and zizmor online audits).
- Improves readability of the existing explanation around triggers and full-history scanning.
File summaries
| File | Description |
|---|---|
.github/workflows/scan.yml |
Clarifies (in comments) the rationale for keeping a weekly scheduled security scan. |
Review details
- Files reviewed: 1/1 changed files
- Comments generated: 1
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| # baseline checks out with `fetch-depth: 0`. The weekly run is for the scanners | ||
| # that consult live state - TruffleHog reports only credentials it can verify, | ||
| # and zizmor's online audits read GitHub - so a secret that was inactive at | ||
| # commit time is caught once it becomes valid. |
Problem
The caller comment says the weekly schedule exists so that detector rules published since the last run find old material. That cannot happen: every scanner in the shared baseline is digest-pinned, gitleaks runs
--network noneand actionlint is offline, so a scheduled run executes byte-identical rules against byte-identical code. New detector versions arrive as a Renovate image bump, which is a pull request, which already scans.Solution
State the reason the schedule genuinely earns its place: TruffleHog runs
--results=verifiedand zizmor performs online audits, so both consult live state. A credential that was inactive when committed is reported once it becomes valid. Gitleaks and actionlint repeat themselves, which the comment now says outright.