fix(security): bring this repo's gates level with its siblings

[webdevsamran]

Each of the four sibling repositories had a security gate the others lacked, so all four were partly unexamined while every one ran a green job named for dependency or security scanning.

	pip-audit	npm audit	secret scan	CodeQL security-extended
before, across the four	3 of 4	1 of 4	1 of 4	1 of 4
this repo gains	—	—	—	npm audit, secret scan, CodeQL security-extended, action-pin check

The shared scanner came with four fixes

Porting it across three more codebases exposed problems the original had in every copy:

• credential-assignment matched across two string literals. Its value class was [^"']{12,}, which can start at the closing quote of one literal and end at the opening quote of the next — write_text("token: " + TOKEN, encoding="utf-8") read as one credential. Real secrets contain no whitespace.
• Caches were scanned, raising a finding against a cached test-id string in .pytest_cache.
• A whole-file marker was missing, which devrepro-doctor needs for its deliberate synthetic-secret corpus.
• The scanner exempted itself — its source contains its own marker constants, so a credential pasted into it would have been invisible. Verified fixed by planting a secret inside the scanner and watching it report itself.

Pinned actions

scripts/check_action_pins.py resolves every pinned SHA against the GitHub API and fails when a version comment disagrees. The pin is the supply-chain control; the comment is what a reviewer reads. It found api-verity-lab calling a v7.0.0 SHA v5.6.0 in five places, and this family disagreeing about the same SHA.

The scanner needed its own test

test_secret_scan_catches_secrets.py plants a real-shaped secret of every class the scanner claims to detect. Writing it found four classes — Slack, Google, Stripe, npm — with no rule at all. Fixtures are assembled from fragments at runtime so no complete credential-shaped literal is committed; GitHub push protection rejected an earlier version that used whole literals, which is useful independent evidence the fixtures are realistic.

A scanner that reports clean is otherwise indistinguishable from one that checks nothing.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.