chore(ci): migrate secrets-scan-daily workflow to GitHub keyless auth

[matiasinsaurralde]

Summary

• Migrate secrets-scan-daily workflow to use GitHub keyless attestation.

[cubic-dev-ai]

1 issue found across 1 file

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name=".github/workflows/secrets-scan-daily.yml">

<violation number="1" location=".github/workflows/secrets-scan-daily.yml:19">
P2: Keep `GITHUB_TOKEN` in this env block so attestation init can still verify the head commit through the GitHub API.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[cubic-dev-ai]

P2: Keep GITHUB_TOKEN in this env block so attestation init can still verify the head commit through the GitHub API.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/secrets-scan-daily.yml, line 19:

<comment>Keep `GITHUB_TOKEN` in this env block so attestation init can still verify the head commit through the GitHub API.</comment>

<file context>
@@ -6,29 +6,18 @@ on:
-      CHAINLOOP_WORKFLOW_NAME: ${{ needs.onboard_workflow.outputs.workflow_name }}
-      CHAINLOOP_PROJECT_NAME: ${{ needs.onboard_workflow.outputs.project_name }}
-      GITHUB_TOKEN: ${{ github.token }}
+      CHAINLOOP_WORKFLOW_NAME: "daily-secrets-detection"
+      CHAINLOOP_PROJECT_NAME: "chainloop"
 
</file context>

Suggested change

	CHAINLOOP_WORKFLOW_NAME: "daily-secrets-detection"
	CHAINLOOP_PROJECT_NAME: "chainloop"
	CHAINLOOP_WORKFLOW_NAME: "daily-secrets-detection"
	CHAINLOOP_PROJECT_NAME: "chainloop"
	GITHUB_TOKEN: ${{ github.token }}