ci(secret-scanner): rename caller job key secret-scan -> scan (D243 floor)

[hyperpolymath]

Why

The estate-wide Secret-Scan-Floor ruleset (owner ruling D243, ruleset 24276940 on this repo) requires the status-check context scan / gitleaks on the default branch. This caller's job key was secret-scan, so it emitted secret-scan / gitleaks, and no PR here could satisfy the floor.

Change

• Job key secret-scan: → scan:. One line.
• The reusable pin (@bd0df9e…) and secrets: inherit are unchanged.

Role in the rollout

Positive-control pilot for D243. Measured: while only scan / gitleaks was pending, mergeStateStatus read BLOCKED; once it went green, UNSTABLE. So the floor gates mergeability. This PR was not armed for auto-merge: scan / gitleaks completed (~20–60 s) before arming could be issued, and arming an UNSTABLE PR merges it instantly. The landing form is pending an owner decision.

🤖 Generated with Claude Code

https://claude.ai/code/session_0136eszqrQ53Kj7aBH1D4rXK

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: bc9e18ae-bc2a-41bb-ae99-f465358a2467

📥 Commits

Reviewing files that changed from the base of the PR and between b6c24dd and 006cfc7.

📒 Files selected for processing (1)

• .github/workflows/secret-scanner.yml

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

⏰ Context from checks skipped due to timeout. (3)

• GitHub Check: semgrep-cloud-platform/scan
• GitHub Check: scan / gitleaks
• GitHub Check: scan / rust-secrets

🔇 Additional comments (1)

.github/workflows/secret-scanner.yml (1)

18-18: LGTM!

---

📝 Summary

Summary by CodeRabbit

• Chores
  • Renamed the secret-scanning workflow job; secret scanning continues as before.

Walkthrough

The secret-scanner workflow job key changes from secret-scan to scan. The reusable workflow and inherited secrets remain unchanged.

Changes

Secret scanner workflow

Layer / File(s)	Summary
Rename workflow job key .github/workflows/secret-scanner.yml	The job key changes from secret-scan to scan. The reusable workflow and inherited secrets remain unchanged.

Priority: ➖ Normal

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Bug fix

Suggested reviewers: metadatastian

Merge Risk: ⚪ Minimal · up to 006cf

The rename produces the required scan / gitleaks check context, with no stale repository job-ID references; no actionable merge-blocking risk remains.

Architecture Summary

Architecture risk: 🔵 Low · up to 006cf

The changed surface does not map to a changed system, dependency edge, entrypoint, or external dependency.

Changed systems: None identified.

Architecture concerns
No architecture-level concerns identified.

Review details

Before / after behavior

• observed — Modified behavior in .github/workflows/secret-scanner.yml: The workflow job key changed from secret-scan to scan; its reusable workflow and inherited secrets remain unchanged.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description check	✅ Passed	The description clearly explains the job-key change and its purpose. It directly relates to the changeset.
Title check	✅ Passed	The title clearly identifies the CI job-key rename from secret-scan to scan. It accurately summarises the main change.

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit checks the scanner's name,
One short key changes in the frame.
The workflow call stays as before,
Inherited secrets keep their door.
The rabbit hops, content with the change.}

_{Comment @coderabbitai help to get the list of available commands.}