ci: adopt the shared scan baseline

[altaywtf]

Problem

This repo carries its own scan workflow copies; every scanner version or digest bump costs a commit here.

Solution

Replace them with the thin caller for uinaf/.github's shared scan (gitleaks, trufflehog, actionlint, zizmor) plus the scoped zizmor policy, and satisfy the baseline where it found real drift. Local zizmor . reports no findings. Scan-copy conversion follow-up from ffsstack#53.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR replaces repository-local secret/workflow scanning CI with a thin caller workflow that delegates to uinaf/.github’s shared scan baseline, and adds a zizmor policy file to align with that baseline.

Changes:

• Removed the repo-specific secret scanning workflow (gitleaks + trufflehog).
• Added a new Scan workflow that calls the shared reusable scan workflow.
• Added a zizmor policy file to allow ref-pinning for the shared workflow source while requiring hash-pinning for everything else.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
.github/zizmor.yml	Adds zizmor unpinned-uses policies intended to accommodate the shared workflow caller.
.github/workflows/secrets.yml	Removes the repo-local secret scanning workflow that is being replaced.
.github/workflows/scan.yml	Introduces the thin caller workflow that delegates scanning to uinaf/.github’s shared workflow.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[slopzapper]

⚡ SLOPS ZAPPED: 1

Verdict: Zaps needed

The caller makes every generated vault execute uinaf/.github at main. That is a live CI dependency and breaks the independent-template contract.

Findings

1. 🧨 MIDSLOP · P1 — Caller uses uinaf/.github scan.yml@main — reckless live hook for generated vaults (.github/workflows/scan.yml:22)

[slopzapper]

🧨 MIDSLOP · P1 · security · 84% confidence

Caller uses uinaf/.github scan.yml@main — reckless live hook for generated vaults

Generated vaults copy this job and then execute whatever is currently on that branch. Secret-scan CI becomes a live dependency on another organization.

⚡ Zap

Restore a hash-pinned in-repo secret-scan workflow and drop the uinaf/.github caller so generated vaults stay self-contained.

🔎 Facts

• code: .github/workflows/scan.yml:22-22 — The new caller binds scan to a mutable branch in uinaf/.github.
• docs: AGENTS.md:22-24 — Generated vaults must stay independent; this template is not a runtime dependency.

[altaywtf]

Closing unmerged: both reviewers are right that a GitHub template repository must not hard-code a uinaf/.github caller — generated vaults copy these workflows verbatim, and third-party consumers would inherit a live dependency on our org. This repo keeps its own scan copy deliberately, which is exactly the escape hatch the gh-setup guidance documents. Recorded on ffsstack#53.