ci: run gitleaks without licensed action wrapper

[100yenadmin]

Summary

• replace the organization-licensed gitleaks-action wrapper with the official Gitleaks v8.30.1 CLI image pinned by immutable multi-platform digest
• keep PR scans bounded to base..head and main push scans on full history
• run with no network, a read-only repository mount, least-privilege workflow permissions, and redacted output
• preflight a non-empty Git range inside the same container so Git discovery failures cannot produce false-success zero-commit scans

Proof

• actionlint .github/workflows/gitleaks.yml: passed
• git diff --check: passed
• linked-worktree inaccessible-Git proof: exited 128 before scanning
• standalone exact promotion range: preflighted 238 commits, Gitleaks scanned 227 patch-bearing commits / 40.35 MB, no leaks, 10.3s
• promotion PR chore(reconciliation): promote proven RC19 internal source candidate #98 will supply the canonical current-head GitHub Actions proof after this workflow commit is incorporated

Closes #99
Parent: #39
Promotion: #98

This PR changes CI only. It does not merge the promotion candidate, publish, release, deploy, roll out runtime changes, or mutate an index.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 9e136fa4-bdea-4aaa-9ed3-60f1fcf63e8b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch reconcile/r25-gitleaks-cli

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

CI Report

✅ All checks passed

Pipeline Status

Stage	Status	Details
✅ Typecheck	success	tsc --noEmit
✅ Tests	success	unit tests, 3 platforms
✅ E2E	success	gitnexus-web changes only

Test Results

Tests	Passed	Failed	Skipped	Duration
14716	14654	0	62	16s

✅ All 14654 tests passed

62 test(s) skipped — expand for details

• antigravity hook adapter e2e > AfterTool — MCP-query hint when MCP server owns the DB (PreToolUse hook silently skips when MCP server owns DB lock — defeats the purpose abhigyanpatwari/GitNexus#2396) > emits the MCP-query hint on stdout, no stderr noise, exit 0 (CLI augment never ran)
• antigravity hook adapter e2e > AfterTool — MCP-query hint when MCP server owns the DB (PreToolUse hook silently skips when MCP server owns DB lock — defeats the purpose abhigyanpatwari/GitNexus#2396) > surfaces the skip reason on stderr only under GITNEXUS_DEBUG=1
• Spring inheritance scaling benchmark (Spring route extraction: ingestion does not resolve interface-inherited mappings (#2280) abhigyanpatwari/GitNexus#2288) > scales linearly with interface×controller pair count
• Spring inheritance pipeline benchmark — end-to-end (Spring route extraction: ingestion does not resolve interface-inherited mappings (#2280) abhigyanpatwari/GitNexus#2288) > full analyze scales linearly with interface→controller pair count
• C# pipeline benchmark > scales with file count — namespaces spread across the solution
• C# pipeline benchmark > scales with file count — all types in one (global) namespace bucket
• C# pipeline benchmark > scales with file count — all types in one (named) namespace bucket
• Ruby pipeline benchmark > scales with file count (workers enabled)
• PreToolUse augmentation filtering (integration) > CJS: emits the MCP-query hint on stdout, stderr silent by default, when a GitNexus MCP process owns the repo DB
• PreToolUse augmentation filtering (integration) > CJS: MCP-owner path emits the MCP query hint; stderr reason gated by GITNEXUS_DEBUG
• PreToolUse augmentation filtering (integration) > CJS: MCP-owner hint emits on stdout; stderr stays silent with GITNEXUS_DEBUG='0'
• PreToolUse augmentation filtering (integration) > CJS: MCP-owner hint emits on stdout; stderr stays silent with GITNEXUS_DEBUG='false'
• PreToolUse augmentation filtering (integration) > Plugin: emits the MCP-query hint on stdout, stderr silent by default, when a GitNexus MCP process owns the repo DB
• PreToolUse augmentation filtering (integration) > Plugin: MCP-owner path emits the MCP query hint; stderr reason gated by GITNEXUS_DEBUG
• PreToolUse augmentation filtering (integration) > Plugin: MCP-owner hint emits on stdout; stderr stays silent with GITNEXUS_DEBUG='0'
• PreToolUse augmentation filtering (integration) > Plugin: MCP-owner hint emits on stdout; stderr stays silent with GITNEXUS_DEBUG='false'
• MCP-owner hint throttle (PreToolUse hook silently skips when MCP server owns DB lock — defeats the purpose abhigyanpatwari/GitNexus#2396) > CJS: emits once, then throttles within the window (marker gates it)
• MCP-owner hint throttle (PreToolUse hook silently skips when MCP server owns DB lock — defeats the purpose abhigyanpatwari/GitNexus#2396) > Plugin: emits once, then throttles within the window (marker gates it)
• MCP hint pattern escaping (PreToolUse hook silently skips when MCP server owns DB lock — defeats the purpose abhigyanpatwari/GitNexus#2396) > CJS: quote+newline pattern stays JSON-safe in additionalContext
• MCP hint pattern escaping (PreToolUse hook silently skips when MCP server owns DB lock — defeats the purpose abhigyanpatwari/GitNexus#2396) > Plugin: quote+newline pattern stays JSON-safe in additionalContext
• Ladybug DB owner guard — production-shaped ps + failure modes (fix: skip Claude augment hook when GitNexus server owns DB abhigyanpatwari/GitNexus#1493) > CJS: skips augment for real node_modules/gitnexus ps line (npx child)
• Ladybug DB owner guard — production-shaped ps + failure modes (fix: skip Claude augment hook when GitNexus server owns DB abhigyanpatwari/GitNexus#1493) > CJS: npx parent command line is NOT treated as GitNexus server owner
• Ladybug DB owner guard — production-shaped ps + failure modes (fix: skip Claude augment hook when GitNexus server owns DB abhigyanpatwari/GitNexus#1493) > CJS: skips augment for gitnexus serve child
• Ladybug DB owner guard — production-shaped ps + failure modes (fix: skip Claude augment hook when GitNexus server owns DB abhigyanpatwari/GitNexus#1493) > CJS: ENOENT lsof → augment still runs (fail-open)
• Ladybug DB owner guard — production-shaped ps + failure modes (fix: skip Claude augment hook when GitNexus server owns DB abhigyanpatwari/GitNexus#1493) > CJS: ETIMEDOUT lsof → augment skipped (fail-closed)
• Ladybug DB owner guard — production-shaped ps + failure modes (fix: skip Claude augment hook when GitNexus server owns DB abhigyanpatwari/GitNexus#1493) > CJS: ETIMEDOUT lsof → emits hint on stdout, stderr silent by default
• Ladybug DB owner guard — production-shaped ps + failure modes (fix: skip Claude augment hook when GitNexus server owns DB abhigyanpatwari/GitNexus#1493) > CJS: ETIMEDOUT lsof with wrapper disabled → identical fail-closed skip
• Ladybug DB owner guard — production-shaped ps + failure modes (fix: skip Claude augment hook when GitNexus server owns DB abhigyanpatwari/GitNexus#1493) > CJS: bad wrapper (no -k support) is rejected by the self-test → still fail-closed
• Ladybug DB owner guard — production-shaped ps + failure modes (fix: skip Claude augment hook when GitNexus server owns DB abhigyanpatwari/GitNexus#1493) > CJS: guard exit 124 (budget expiry) → fail-closed skip
• Ladybug DB owner guard — production-shaped ps + failure modes (fix: skip Claude augment hook when GitNexus server owns DB abhigyanpatwari/GitNexus#1493) > CJS: guard signal-death (status null + signal, no error) → fail-closed skip
• Ladybug DB owner guard — production-shaped ps + failure modes (fix: skip Claude augment hook when GitNexus server owns DB abhigyanpatwari/GitNexus#1493) > CJS: always-exit-0 stub guard is rejected → augment still runs and emits context
• Ladybug DB owner guard — production-shaped ps + failure modes (fix: skip Claude augment hook when GitNexus server owns DB abhigyanpatwari/GitNexus#1493) > CJS: non-GitNexus ps line → augment runs
• Ladybug DB owner guard — production-shaped ps + failure modes (fix: skip Claude augment hook when GitNexus server owns DB abhigyanpatwari/GitNexus#1493) > CJS: multiple PIDs — skip if any ps line is GitNexus MCP
• Ladybug DB owner guard — production-shaped ps + failure modes (fix: skip Claude augment hook when GitNexus server owns DB abhigyanpatwari/GitNexus#1493) > CJS: ps ENOENT → augment runs (ignore that PID)
• Ladybug DB owner guard — production-shaped ps + failure modes (fix: skip Claude augment hook when GitNexus server owns DB abhigyanpatwari/GitNexus#1493) > Plugin: skips augment for real node_modules/gitnexus ps line (npx child)
• Ladybug DB owner guard — production-shaped ps + failure modes (fix: skip Claude augment hook when GitNexus server owns DB abhigyanpatwari/GitNexus#1493) > Plugin: npx parent command line is NOT treated as GitNexus server owner
• Ladybug DB owner guard — production-shaped ps + failure modes (fix: skip Claude augment hook when GitNexus server owns DB abhigyanpatwari/GitNexus#1493) > Plugin: skips augment for gitnexus serve child
• Ladybug DB owner guard — production-shaped ps + failure modes (fix: skip Claude augment hook when GitNexus server owns DB abhigyanpatwari/GitNexus#1493) > Plugin: ENOENT lsof → augment still runs (fail-open)
• Ladybug DB owner guard — production-shaped ps + failure modes (fix: skip Claude augment hook when GitNexus server owns DB abhigyanpatwari/GitNexus#1493) > Plugin: ETIMEDOUT lsof → augment skipped (fail-closed)
• Ladybug DB owner guard — production-shaped ps + failure modes (fix: skip Claude augment hook when GitNexus server owns DB abhigyanpatwari/GitNexus#1493) > Plugin: ETIMEDOUT lsof → emits hint on stdout, stderr silent by default
• Ladybug DB owner guard — production-shaped ps + failure modes (fix: skip Claude augment hook when GitNexus server owns DB abhigyanpatwari/GitNexus#1493) > Plugin: ETIMEDOUT lsof with wrapper disabled → identical fail-closed skip
• Ladybug DB owner guard — production-shaped ps + failure modes (fix: skip Claude augment hook when GitNexus server owns DB abhigyanpatwari/GitNexus#1493) > Plugin: bad wrapper (no -k support) is rejected by the self-test → still fail-closed
• Ladybug DB owner guard — production-shaped ps + failure modes (fix: skip Claude augment hook when GitNexus server owns DB abhigyanpatwari/GitNexus#1493) > Plugin: guard exit 124 (budget expiry) → fail-closed skip
• Ladybug DB owner guard — production-shaped ps + failure modes (fix: skip Claude augment hook when GitNexus server owns DB abhigyanpatwari/GitNexus#1493) > Plugin: guard signal-death (status null + signal, no error) → fail-closed skip
• Ladybug DB owner guard — production-shaped ps + failure modes (fix: skip Claude augment hook when GitNexus server owns DB abhigyanpatwari/GitNexus#1493) > Plugin: always-exit-0 stub guard is rejected → augment still runs and emits context
• Ladybug DB owner guard — production-shaped ps + failure modes (fix: skip Claude augment hook when GitNexus server owns DB abhigyanpatwari/GitNexus#1493) > Plugin: non-GitNexus ps line → augment runs
• Ladybug DB owner guard — production-shaped ps + failure modes (fix: skip Claude augment hook when GitNexus server owns DB abhigyanpatwari/GitNexus#1493) > Plugin: multiple PIDs — skip if any ps line is GitNexus MCP
• Ladybug DB owner guard — production-shaped ps + failure modes (fix: skip Claude augment hook when GitNexus server owns DB abhigyanpatwari/GitNexus#1493) > Plugin: ps ENOENT → augment runs (ignore that PID)
• Go pipeline benchmark > scales with file count (workers enabled)
• Go pipeline benchmark — worker pool (issue Worker idle timeout kills long Go scope extraction and surfaces as Napi::Error during analyze abhigyanpatwari/GitNexus#1848) > does not quarantine the large generated Go file on sub-batch idle timeout
• Go structural interface detection benchmark > scales linearly with interface × struct count
• Go structural interface detection split-phase benchmark > separates index-build and detection time
• C++ pipeline benchmark > scales with file count
• Rust pipeline benchmark > scales with file count (workers enabled)
• C++ ADL emit benchmark > emit phase scales sub-quadratically with co-scaled files and sites
• Vue pipeline benchmark > scales with component count
• getOsPageSize > returns undefined on Windows without forking
• C++ capture identifier-type-lookup benchmark > capture emit scales sub-quadratically with co-scaled enums and call sites
• run.cjs direct-exec entrypoint (fix(cli): steer docs, skills, and hooks through a CLI-neutral project-local runner (#1939) abhigyanpatwari/GitNexus#1945) > resolves a .cmd shim via the Windows shell branch, passing args and exit code
• buildTypeEnv > known limitations (documented skip tests) > Ruby block parameter: users.each { |user| } — closure param inference, different feature
• COBOL pipeline benchmark > scales with file count
• PHP pipeline benchmark > scales with file count (workers enabled)

Code Coverage

Tests

Metric	Coverage	Covered	Base	Delta	Status
Statements	80.9%	54752/67676	N/A%	—	🟢 ████████████████░░░░
Branches	68.01%	33640/49462	N/A%	—	🟢 █████████████░░░░░░░
Functions	87.08%	6367/7311	N/A%	—	🟢 █████████████████░░░
Lines	84.41%	48851/57869	N/A%	—	🟢 ████████████████░░░░

---

_{📋 View full run · Generated by CI}