ci: pin SARIF uploads and qualify the Git hook scanner - #733

Scope

Update the four existing SARIF upload references to CodeQL Action v4.38.2 and qualify the unchanged Git pre-commit command with pinned Gitleaks8.30.1. This retained PR folds #767 at 206cb8cfe082e673aa5c79eb9b6054a968772e51, under FOLDS-RULED (CC review023012Z). All six nonhot files from #767 are byte-identical; its branch remains kept. The central installer owns integrating the supplied scanner prerequisite; the co-op applies host changes after acceptance.

• Base: 4fd710698f53c3581cb1cfe9258ef7b1854ac080; fold starts from ci: pin SARIF uploads and qualify the Git hook scanner #733's d92ef564bc80f0c1d0630202606da2fa59f8e7aa. No rebase accompanies this content fold.
• Lane: lane:foundation; draft until the exact-head cross-family read and command-center ACK.
• Paths: existing security-scan.yml/scorecard.yml, their decision/receipt; adoption/git-hook-acceptance.md, scanner decision, prerequisite artifacts and acceptance receipt, tests/test_adoption_guarded_runners.py; manifests/evidence.json only in the last commit.
• Named landing path: co-op GPT delta read of the combined head (reuse original adoption: qualify pinned Git hook scanner on 2604 #767 read after byte verification), command-center exact-head ACK including CI, then5f lands at the approved ci: pin SARIF uploads and qualify the Git hook scanner #733 LAND position in ranks12–49, after the critical queue. ci: bump github/codeql-action/upload-sarif from 4.38.1 to 4.38.2 in the github-actions-minor-patch group across 1 directory #690 closes only after ci: pin SARIF uploads and qualify the Git hook scanner #733 lands; the co-op closes adoption: qualify pinned Git hook scanner on 2604 #767 with its record after verifying6/6 bytes. This lane merges/closes neither.

SOTA sources

• CodeQL Action v4.38.2, github/codeql-action@2892aa5:upload-sarif/action.yml:43. Descriptor remains identical to v4.38.1; existing inputs/triggers/permissions/upload guards remain preserved.
• Gitleaks v8.30.1, gitleaks/gitleaks@83d9cd68:README.md and config/config.go:19-20. Native exit semantics: Git pre-commit, read2026-10-06. Betterleaks@81aff7a6:config/config.go:22-23/config/betterleaks.toml has a different default rule set, so it fails the approved equivalence condition.
• mise aqua backend; jdx/mise@050ce5a:registry/gitleaks.toml:1, docs/directories.md:13, docs/cli/prune.md:14-17. Uses supported isolated upstream installation, no rebuild.
• MADR template; review/overturn fields are campaign policy.
• Original immutable hook recipe/evidence: 206cb8c:adoption/git-hook-acceptance.md and evidence/receipts/p1-git-hook-acceptance-20261006.json. The recipe retains the existing guarded launcher and pre-push prerequisites.
• Fold/hot registry: d92ef56:docs/lanes.md:94 and docs/acceptance-evidence-policy.md; scripts/host_receipts.py:register_file. Retained registry re-registers the six paths, preserving receipts/convergence arrays and all original ci: pin SARIF uploads and qualify the Git hook scanner #733 content.

Evidence-class table

Local commands run

rtk env TMPDIR=<durable external cache> nice -n 19 ionice -c3 python3 -m unittest tests.test_adoption_guarded_runners
# exit0;33tests,1skip,7.013s
scripts.host_receipts.register_file for the six original #767 registered paths
# exit0;5entries added,1updated; no deleted registry path
rtk env TMPDIR=<durable external cache> nice -n 19 ionice -c3 python3 scripts/validate.py
# exit0;69components,10145hashed_files,4profiles,203receipts
rtk proxy git diff --check d92ef564bc80f0c1d0630202606da2fa59f8e7aa HEAD
# exit0

Failed attempts remain separately retained in the original receipts: the two failed native R4 SDK attempts, successful19-request edit attempt, unavailable SDK terminal validation runner, and nonexistent foundation_component_matrix.py command corrected to new_host_grand_list.py. Billing/unknown usage stays UNKNOWN. Historical acceptance and this fold's checks remain separate.

Decision record

docs/decisions/2026-10-05-ci-upload-sarif-pin.md and docs/decisions/2026-10-06-git-hook-scanner-pin.md are copied without changing decided text or recorded results. Sources/tag/interface mismatch or required-check failures overturn the upload selection; scanner/default-rule equivalence and a real blocked-secret/clean-commit check govern the hook prerequisite.

Host evidence

No evidence/hosts file or active host setting changes. The co-op's exact apply/read-back/rollback command blocks are in adoption/git-hook-acceptance.md (byte-identical to #767); they are part of this PR and must run in their stated order, including checkpoint, guard, native binary hash, external TMPDIR and Zizmor checks. Compact command index:

# Apply, after the recipe's checkpoint and public-tool-path backup:
nice -n 19 ionice -c3 mise install --jobs=1 aqua:gitleaks/[email protected]
native_dir="$(mise where aqua:gitleaks/[email protected])"
install -D -m 0755 "$repo/adoption/tools/gitleaks-guarded" "$eco/bin/gitleaks"
install -D -m 0755 "$repo/adoption/tools/ecosystem-bounded-run" "$eco/bin/ecosystem-bounded-run"
mkdir -p "$eco/tools/gitleaks-8.30.1"
install -m 0755 "$native_dir/gitleaks" "$eco/tools/gitleaks-8.30.1/gitleaks"
# Run the recipe's pinned-hash/PATH/version/Zizmor checks before this setting:
git -C "$repo" config --local core.hooksPath scripts/git-hooks
# Read-back, then the recipe's real clean/blocked scratch-clone commit check:
git -C "$repo" config --local --get core.hooksPath
command -v gitleaks
gitleaks version
sha256sum "$eco/tools/gitleaks-8.30.1/gitleaks"
command -v zizmor
# Rollback: restore only checkpoint's prior hooksPath/public paths; remove only
# newly introduced tool paths; uninstall pinned mise tool only if absent before.

Full scratch-clone acceptance and exact rollback argv are retained in the recipe; no host command above was applied by this lane during the fold. Enabling hooksPath also activates the existing pre-push gate, so its prerequisites are explicit.

Checklist

• Changed GitHub Actions keep full SHAs/version comments and existing least-privilege grants.
• No credential value/file read, printed or copied; no new required secret.
• No paid service or native client configuration change.
• Original adoption: qualify pinned Git hook scanner on 2604 #767 files and ci: pin SARIF uploads and qualify the Git hook scanner #733 content preserved; registry last.
• Exact-head delta read, command-center ACK and combined-head hosted CI.