From 9d5cd8acb3783a9e42308acfde26e0ea5ffdf42c Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Thu, 8 Oct 2026 12:40:42 +0100
Subject: [PATCH] ci: drop the GitGuardian job; relock without losing reusable
 edges

ggshield-action is in neither standards allowlist canon, the repo has
no GITGUARDIAN_API_KEY secret, and the estate secret scanner
(secret-scanner.yml) already runs. Owner ruling 2026-10-08.

The lock is regenerated (it was valid:false on main: Dependabot moved
sonarqube-scan-action to v8.3.0 and codeql-action to v4.38.2 without a
relock). The regeneration drops the eight SHA-form transitive entries
that #123 pinned for called reusables, so they are carried over
verbatim. gh actions-lock --verify-local: valid:true (one advisory
sha-as-ref, pre-existing).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012kgrMQRhSmZMBbF9Ui1zBw
---
 .github/workflows/actions.lock      | 22 ++++++++------------
 .github/workflows/ci-benchmarks.yml | 31 +++++------------------------
 2 files changed, 13 insertions(+), 40 deletions(-)

diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock
index c934dc0..5c9109a 100644
--- a/.github/workflows/actions.lock
+++ b/.github/workflows/actions.lock
@@ -7,12 +7,11 @@ workflows:
         - 'actions/checkout@v7.0.1'
         - 'actions/upload-artifact@v7.0.1'
         - 'erlef/setup-beam@v1.24.1'
-        - 'gitguardian/ggshield-action@v1.54.0'
         - 'julia-actions/setup-julia@v3.0.2'
-        - 'sonarsource/sonarqube-scan-action@v8.2.2'
+        - 'sonarsource/sonarqube-scan-action@v8.3.0'
     '.github/workflows/codeql.yml':
         - 'actions/checkout@v7.0.1'
-        - 'github/codeql-action@v4.38.0'
+        - 'github/codeql-action@v4.38.2'
     '.github/workflows/governance.yml': []
     '.github/workflows/hypatia-scan.yml': []
     '.github/workflows/instant-sync.yml':
@@ -68,14 +67,9 @@ dependencies:
         commit: 'sha1-54075bcc5e249e4758d363f27d099f55d843f124'
         owner_id: 47606891
         repo_id: 331103973
-    'gitguardian/ggshield-action@v1.54.0':
-        ref: 'v1.54.0'
-        commit: 'sha1-7059aef1ffb7d2374ce27201144f5613beecefe0'
-        owner_id: 27360172
-        repo_id: 272400318
-    'github/codeql-action@v4.38.0':
-        ref: 'v4.38.0'
-        commit: 'sha1-b96794f015dfd88f77b49b1c93e0fa7110f94c63'
+    'github/codeql-action@v4.38.2':
+        ref: 'v4.38.2'
+        commit: 'sha1-2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2'
         owner_id: 9919
         repo_id: 259445878
     'hyperpolymath/smtp-notify-action@v0.3.0':
@@ -98,9 +92,9 @@ dependencies:
         commit: 'sha1-28959ce8df70de7be546dd1250a005dd32156697'
         owner_id: 18365890
         repo_id: 220359305
-    'sonarsource/sonarqube-scan-action@v8.2.2':
-        ref: 'v8.2.2'
-        commit: 'sha1-ba9859eae8dd6bd29e412f25ddbbef3d032000f4'
+    'sonarsource/sonarqube-scan-action@v8.3.0':
+        ref: 'v8.3.0'
+        commit: 'sha1-d209202bc7d53ff1cc128f7f907dac145c9d6ae9'
         owner_id: 545988
         repo_id: 366408409
     'actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9':
diff --git a/.github/workflows/ci-benchmarks.yml b/.github/workflows/ci-benchmarks.yml
index 8c81fa2..f26b0e6 100644
--- a/.github/workflows/ci-benchmarks.yml
+++ b/.github/workflows/ci-benchmarks.yml
@@ -7,9 +7,8 @@
 # Runs:
 # 1. Database-specific tests
 # 2. Central benchmarks from proven-tests-and-benchmarks repo
-# 3. GitGuardian secret scanning
-# 4. SonarQubeCloud quality analysis
-# 5. KRL verification tests
+# 3. SonarQubeCloud quality analysis
+# 4. KRL verification tests
 
 name: CI - Tests & Benchmarks
 
@@ -117,27 +116,7 @@ jobs:
           path: proven/benchmarks/quandledb/results.json
           retention-days: 30
 
-  # Job 3: GitGuardian secret scanning
-  gitguardian:
-    name: GitGuardian Secret Scan
-    needs: quandledb-tests
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v7.0.1
-        with:
-          fetch-depth: 0
-
-      - name: GitGuardian scan
-        uses: GitGuardian/ggshield-action@v1.55.0
-        with:
-          args: scan repo .
-        env:
-          GITGUARDIAN_API_KEY: ${{ secrets.GITGUARDIAN_API_KEY }}
-
-  # Job 4: SonarQubeCloud quality analysis
+  # Job 3: SonarQubeCloud quality analysis
   sonarqube:
     name: SonarQubeCloud Analysis
     needs: quandledb-tests
@@ -161,14 +140,14 @@ jobs:
         env:
           SONAR_TOKEN: ${{ secrets.SONARQUBE_TOKEN }}
 
-  # Job 5: CodeQL analysis (existing)
+  # Job 4: CodeQL analysis (existing)
   codeql:
     name: CodeQL Analysis
     needs: quandledb-tests
     uses: ./.github/workflows/codeql.yml
     secrets: inherit
 
-  # Job 6: Dependabot (existing)
+  # Job 5: Dependabot (existing)
   dependabot:
     name: Dependabot
     needs: quandledb-tests