fix(ci): drop the retired inline trufflehog job

[hyperpolymath]

The permission fix has landed, so Secret Scanner now starts — gitleaks, rust-secrets and shell-secrets all pass. But the workflow still reports red, because of a vestigial inline trufflehog job.

secret-scanner-reusable.yml deliberately retired TruffleHog as redundant — from its own header:

Trufflehog removed: gitleaks provides sufficient coverage at lower cost.

The inline job was left behind when the repo moved to the reusable. It fails and reds the whole workflow, so the repo keeps emitting ci_activity notifications even though secret scanning is green.

This removes the retired job. Coverage is unchanged — gitleaks in the reusable already covers it.

🤖 Generated with Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 15 issues detected

Severity	Count
🔴 Critical	0
🟠 High	3
🟡 Medium	12

View findings

[
  {
    "reason": "Action actions/checkout@v4 needs attention",
    "type": "unpinned_action",
    "file": "pages.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action actions/checkout@v4 needs attention",
    "type": "unpinned_action",
    "file": "pages.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action actions/upload-pages-artifact@v3 needs attention",
    "type": "unpinned_action",
    "file": "pages.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action actions/deploy-pages@v4 needs attention",
    "type": "unpinned_action",
    "file": "pages.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in push-email-notify.yml",
    "type": "missing_timeout_minutes",
    "file": "push-email-notify.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "binary_to_term without :safe option -- deserialization attack (1 occurrences, CWE-502)",
    "type": "elixir_send_unsanitised",
    "file": "/home/runner/work/phronesis/phronesis/lib/phronesis/compiler.ex",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "1 workflow(s) with tag-pinned (not SHA-pinned) actions in phronesis",
    "type": "DependencyPinning",
    "file": "/home/runner/work/phronesis/phronesis",
    "action": "auto_fix",
    "rule_module": "scorecard",
    "severity": "medium",
    "remediation": "Pin GitHub Actions and Docker base images by SHA hash.",
    "scorecard_check": "Pinned-Dependencies"
  },
  {
    "reason": "Code scanning (Hypatia): hypatia/scorecard/DependencyPinning -- Hypatia scorecard: DependencyPinning -- 1 day(s) old",
    "type": "CSA001",
    "file": "phronesis",
    "action": "review",
    "rule_module": "code_scanning_alerts",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Hypatia): hypatia/workflow_audit/unpinned_action -- Hypatia workflow_audit: unpinned_action -- 1 day(s) old",
    "type": "CSA001",
    "file": "pages.yml",
    "action": "review",
    "rule_module": "code_scanning_alerts",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Hypatia): hypatia/workflow_audit/unpinned_action -- Hypatia workflow_audit: unpinned_action -- 1 day(s) old",
    "type": "CSA001",
    "file": "pages.yml",
    "action": "review",
    "rule_module": "code_scanning_alerts",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence