ci: 3 repos run no security scanning — including Kubernetes and the CI runner image

[BryanFRD]

19 of 22 FerrLabs repos run security-scan.yml (gitleaks, trufflehog, osv-scanner, opengrep, snyk, zizmor). Three do not, and the gaps land on repos where it matters most.

Repo	security-scan	pr-title	Note
Kubernetes	—	—	180 cluster manifests, SOPS, Vault config
actions-runner-image	—	—	the image every CI job runs on
Claude-Agents	—	—	99 files

This is not hypothetical on Kubernetes

A GitHub PAT sat committed in plaintext in Kubernetes/TODO.md for roughly three months (see FerrLabs/Kubernetes#32). gitleaks — already part of the standard security-scan.yml running in 19 sibling repos — matches ghp_ by default and would have failed the push that introduced it.

The repo that holds the cluster's secret-management configuration is the one repo without secret scanning.

actions-runner-image is the higher-severity gap

It builds the container image that every self-hosted CI job executes in. A compromise there reaches every repo in the org, every build, every credential mounted into a job. It currently gets no CVE scanning (osv-scanner), no SAST, and no Actions-workflow linting (zizmor). It does run sonarqube.yml, which is not a substitute for any of those.

Scope

Add the standard workflows to the three repos, matching the sibling setup:

• security-scan.yml — same reusable call the other 19 use
• pr-title.yml — conventional-commit enforcement, so squash-merge titles stay valid (these three currently accept any PR title, which quietly breaks the changelog/versioning convention)

Two adjustments worth making rather than copying blindly:

• Kubernetes is YAML-only, so the SAST/dependency steps will mostly no-op — the value there is gitleaks + trufflehog, and it is worth confirming trufflehog's deep-history mode actually runs rather than being skipped
• actions-runner-image builds a container, so it should additionally scan the built image, not just the Dockerfile — the current workflows scan source only

Also worth deciding

No repo runs codeql any more. On private repos that is a licensing consequence (Code Security is paid), not an oversight — but FerrFlow and FerrVault are public, where CodeQL is free. Whether to re-enable it there is a deliberate call worth recording somewhere, since the previous removal was driven by the private-repo cost.

Acceptance

• The three repos run security-scan.yml on PR and on push to the default branch
• A test commit containing a fake ghp_-shaped string fails CI on Kubernetes