security-scan gate (shared felhom.eu/scripts/security_scan_gate.py) in the fast set and CI, warn-first, with the accepted-hits file and decoys (R-986)

2026-10-19 21:11:31 +02:00
parent c4b3b0a039
commit a03c25aa1f
5 changed files with 56 additions and 0 deletions
@@ -52,6 +52,10 @@ jobs:
      - name: Run the gate entry point
        # The ONLY thing CI runs. No go build, no go test, no linting, no deploy. The
        # exit code IS the result: no `|| true`, no pipe that could swallow it.
+        env:
+          # R-986: the security-scan gate fetches the PINNED gitleaks here (sha256-checked); no Go, so govulncheck says
+          # NOT CHECKED in CI, out loud. Warn-first either way: the scan lists, it never fails this job.
+          FELHOM_SCAN_FETCH: "1"
        run: cd ws/felhom-controller/controller && python3 scripts/controller_gates.py --fast

      - name: Manual proof - alarm key present, optional forced failure (dispatch only, R-1129)