From 493fcdd698af1285e9f955ca9166b5c7031d2c5d Mon Sep 17 00:00:00 2001
From: Donovan Baney <baneydonovan@gmail.com>
Date: Sat, 7 Nov 2026 22:08:21 -0500
Subject: [PATCH] Add repo standards and secret scanning (replaces GitGuardian)

Calls baney75/.github's repo-standards workflow: gitleaks over the whole history on every push and
pull request, a weekly live-key check, and the repo standard with a ratchet baseline of today's problems.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/repo-standards-baseline.json |  8 ++++++++
 .github/workflows/repo-standards.yml | 17 +++++++++++++++++
 2 files changed, 25 insertions(+)
 create mode 100644 .github/repo-standards-baseline.json
 create mode 100644 .github/workflows/repo-standards.yml

diff --git a/.github/repo-standards-baseline.json b/.github/repo-standards-baseline.json
new file mode 100644
index 0000000..2d2bf8b
--- /dev/null
+++ b/.github/repo-standards-baseline.json
@@ -0,0 +1,8 @@
+{
+  "date": "2026-11-07",
+  "problems": [
+    "agents: UI repo missing DESIGN.md",
+    "logging: the service logs no structured lines (JSON or a structured logger)",
+    "readme: README has no badges row (public repo with CI)"
+  ]
+}
diff --git a/.github/workflows/repo-standards.yml b/.github/workflows/repo-standards.yml
new file mode 100644
index 0000000..b07c6bf
--- /dev/null
+++ b/.github/workflows/repo-standards.yml
@@ -0,0 +1,17 @@
+# Secret scanning and the repo standard. The logic lives in https://github.com/baney75/.github
+# (.github/workflows/repo-standards.yml) so every repository stays in step. Replaces GitGuardian.
+name: Repo standards
+on:
+  pull_request:
+  push:
+    branches: ["main"]
+  schedule:
+    - cron: "41 7 * * 1"  # weekly: also checks whether any key in history is still live
+  workflow_dispatch:
+permissions: {}
+jobs:
+  standards:
+    uses: baney75/.github/.github/workflows/repo-standards.yml@main
+    permissions:
+      contents: read
+      actions: read