Fix(ci): fetch-depth sans filtre de blobs -- 23x filter blob:none + gitleaks depth 1 (roo-extensions #4376, item 3)

.github/workflows/catalog-cron.yml

@@ -110,6 +110,7 @@ jobs:
         with:
           ref: main
           fetch-depth: 0          # full history so git-derived fields are exact
+          filter: blob:none
           persist-credentials: true
 
       # Prepare the long-lived branch from origin/main. We reset (not rebase)

.github/workflows/closed-unmerged-pr-scan.yml

@@ -59,6 +59,7 @@ jobs:
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
+          filter: blob:none
 
       - name: Fetch ALL remote heads
         # The scan diffs each closed PR's branch against main for content

.github/workflows/consecutive-code-cells-advisory.yml

@@ -70,6 +70,7 @@ jobs:
         with:
           # Need base..head history for `git diff` of changed notebooks.
           fetch-depth: 0
+          filter: blob:none
 
       - name: Set up Python
         uses: actions/setup-python@v5

.github/workflows/enrich-quality-gate.yml

@@ -63,6 +63,7 @@ jobs:
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
+          filter: blob:none
 
       - name: Set up Python
         uses: actions/setup-python@v5

.github/workflows/evict-orphan-caches.yml

@@ -94,6 +94,7 @@ jobs:
         uses: actions/checkout@v4
         with:
           fetch-depth: 0   # git merge-base --is-ancestor a besoin du graphe
+          filter: blob:none
           sparse-checkout: |
             .github/workflows/evict-orphan-caches.yml
             scripts/ci/evict_orphan_caches.py

.github/workflows/exercise-leak-ci.yml

@@ -50,6 +50,7 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0   # base ref must be reachable for the BASE scan
+          filter: blob:none
 
       - uses: actions/setup-python@v5
         with:

.github/workflows/h1-hygiene-advisory.yml

@@ -39,6 +39,7 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0   # base ref must be reachable for the added-files diff
+          filter: blob:none
 
       - uses: actions/setup-python@v5
         with:

.github/workflows/lean-visibility-advisory.yml

@@ -59,6 +59,7 @@ jobs:
           # Le mode --pr-base fait un diff 3-points base...HEAD : il faut
           # l'historique.
           fetch-depth: 0
+          filter: blob:none
 
       - name: Set up Python
         uses: actions/setup-python@v5

.github/workflows/markdown-claims-output-advisory.yml

@@ -74,6 +74,7 @@ jobs:
           # The detector requires merge-base(origin/main, HEAD). A depth-1
           # checkout made the advisory abstain on ordinary pull requests.
           fetch-depth: 0
+          filter: blob:none
 
       - uses: actions/setup-python@v5
         with:

.github/workflows/markdown-deaccent-advisory.yml

@@ -71,6 +71,7 @@ jobs:
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
+          filter: blob:none
 
       - name: Set up Python
         uses: actions/setup-python@v5

.github/workflows/mermaid-fill-color-advisory.yml

@@ -75,6 +75,7 @@ jobs:
         with:
           # Need base..head history for `git diff` of changed files.
           fetch-depth: 0
+          filter: blob:none
 
       - name: Set up Python
         uses: actions/setup-python@v5

.github/workflows/notebook-cell-source-parses.yml

@@ -69,6 +69,7 @@ jobs:
     - uses: actions/checkout@v4
       with:
         fetch-depth: 0
+        filter: blob:none
 
     - name: Set up Python
       uses: actions/setup-python@v5

.github/workflows/notebook-latex-control-chars.yml

@@ -67,6 +67,7 @@ jobs:
     - uses: actions/checkout@v4
       with:
         fetch-depth: 0
+        filter: blob:none
 
     - name: Set up Python
       uses: actions/setup-python@v5

.github/workflows/notebook-math-render.yml

@@ -80,6 +80,7 @@ jobs:
     - uses: actions/checkout@v4
       with:
         fetch-depth: 0
+        filter: blob:none
 
     - name: Set up Python
       uses: actions/setup-python@v5

.github/workflows/notebook-nav-chain-guard.yml

@@ -43,6 +43,7 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
+          filter: blob:none
 
       # La jambe Linux conteneurisee n'expose pas de `python` systeme (job
       # 100021313259, exit 127) : l'interprete vient de setup-python, comme

.github/workflows/orphan-branch-scan.yml

@@ -56,6 +56,7 @@ jobs:
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
+          filter: blob:none
 
       - name: Fetch ALL remote heads
         # actions/checkout@v4 only fetches the default branch. The scan diffs

.github/workflows/paragraph-length-advisory.yml

@@ -78,6 +78,7 @@ jobs:
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
+          filter: blob:none
 
       - name: Set up Python
         uses: actions/setup-python@v5

.github/workflows/readme-ipynb-links-guard.yml

@@ -87,6 +87,7 @@ jobs:
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
+          filter: blob:none
 
       # La PR ne doit PAS introduire de nouvelle violation HTML_404
       # (#18911 geste 2, 2026-10-09). On compare la PR (head) a la base (main)

.github/workflows/repeated-prose-advisory.yml

@@ -57,6 +57,7 @@ jobs:
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
+          filter: blob:none
 
       - name: Set up Python
         uses: actions/setup-python@v5

.github/workflows/repo-size-advisory.yml

@@ -40,6 +40,7 @@ jobs:
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
+          filter: blob:none
 
       - name: Scan added blobs above threshold
         env:

.github/workflows/scan-md-hierarchy-drift.yml

@@ -54,6 +54,7 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
+          filter: blob:none
       # #17407 / #17444 : `python` nu n'est pas expose par les slots natifs du
       # parc coursia-linux (contrat image seulement). Sans interpreteur, le scan
       # ne tourne pas -- et `rc=127` n'est teste par AUCUNE branche du script

.github/workflows/secret-scan.yml

@@ -82,16 +82,21 @@ jobs:
     # Borne de securite (incident du 15/10) : sur nos slots ephemeres, un run
     # fige sans borne tient un slot 6 h (defaut d'Actions) et le retire aux PR
     # gates ; 16 des 18 slots etaient occupes de cette facon le 15/10.
-    # Duree mesuree sur 20 runs verts heberges : mediane 1,8 min, max 16,4 min
-    # (clone `fetch-depth: 0` complet) -> borne a 30 min, la plus large des
-    # quatre jobs hybrides de cette PR.
+    # Mesure du 2026-10-27 (commit eae2eb24d1, #22953), faite sur la forme a
+    # `fetch-depth: 0` : 20 runs verts heberges, mediane 1,8 min, max 16,4 min
+    # -> borne a 30 min, la plus large des quatre jobs hybrides de cette PR.
+    # Depuis #22799 le checkout de ce job est en `fetch-depth: 1` (gitleaks
+    # detect --no-git ne lit que l'arbre de travail) : la duree sur cette
+    # nouvelle forme n'a PAS ete re-mesuree. Cette borne reste ce qu'elle a
+    # toujours ete -- une borne de securite contre le run fige qui tient un
+    # slot 6 h, pas une prevision de duree.
     timeout-minutes: 30
     env:
       GITLEAKS_VERSION: 8.24.3
     steps:
       - uses: actions/checkout@v4
         with:
-          fetch-depth: 0
+          fetch-depth: 1  # gitleaks detect --no-git : arbre de travail seul, l'historique n'est pas scanne
 
       - name: Fetch gitleaks binary (pinned)
         run: |
@@ -156,7 +161,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
         with:
-          fetch-depth: 0
+          fetch-depth: 1  # gitleaks detect --no-git : arbre de travail seul, l'historique n'est pas scanne
 
       - name: Log gitleaks binary version (CI must equal pre-commit rev)
         run: |

.github/workflows/source-output-ratchet.yml

@@ -69,6 +69,7 @@ jobs:
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
+          filter: blob:none
 
       - name: Set up Python
         uses: actions/setup-python@v5

.github/workflows/split-reading-advisory.yml

@@ -61,6 +61,7 @@ jobs:
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
+          filter: blob:none
 
       - name: Set up Python
         uses: actions/setup-python@v5

scripts/notebook_tools/audit_workflow_path_filters.py

@@ -104,12 +104,12 @@
 # donc besoin du clone complet par construction, et n'est pas une regression.
 # Liste OPT-IN : ajouter un nom ici uniquement apres justification ecrite
 # (cf. issue #12385, hygiène de checkout de la série clone partiel #11843).
-CHECKOUT_HYGIENE_FULL_HISTORY_WORKFLOWS: set[str] = {
-    # gitleaks scanne les BLOBS de l'historique git complet. `filter: blob:none`
-    # (clone partiel) ne checkout pas les blobs, donc gitleaks ne verrait rien.
-    # Un clone complet est requis par construction.
-    "secret-scan.yml",
-}
+# Retrait de `secret-scan.yml` (2026-10-26) : sa justification (« gitleaks
+# scanne les BLOBS de l'historique ») date de l'ere gitleaks-action ; les deux
+# jambes invoquent desormais `detect --no-git` (arbre de travail seul, mesure
+# au source) et son checkout est passe a `fetch-depth: 1` -- le workflow n'a
+# plus besoin du clone complet, l'exclusion ne protegeait plus rien.
+CHECKOUT_HYGIENE_FULL_HISTORY_WORKFLOWS: set[str] = set()
 
 
 def _parse_on_key(data: dict[str, Any]) -> dict[str, Any] | None:
@@ -530,9 +530,15 @@ def _synthetic_checkout_workflows_dir(tmp: Path) -> Path:
     Cinq cas couvrent les criteres cumulatifs :
       1. bad-clone.yml    : pull_request + fetch-depth:0 sans blob:none -> NON CONFORME
       2. good-clone.yml   : pull_request + fetch-depth:0 + blob:none      -> conforme
-      3. secret-scan.yml  : pull_request + fetch-depth:0, dans l'exclusion -> exclu
+      3. depth-1.yml      : pull_request + fetch-depth:1 -> hors scope (pas de depth 0 ;
+                           le motif reel de secret-scan.yml depuis qu'il scanne en --no-git)
       4. push-only.yml    : push + fetch-depth:0, pas de trigger PR        -> hors scope
       5. bad-target.yml   : pull_request_target + fetch-depth:0 sans blob:none -> NON CONFORME
+
+    L'exclusion (liste OPT-IN, vide depuis le retrait de secret-scan.yml le
+    2026-10-26) n'a plus de cas ici : son mecanisme reste couvert par
+    test_checkout_hygiene_excluded (monkeypatch), qui n'herisse pas de la
+    liste reelle.
     """
     wf = tmp / "workflows"
     wf.mkdir(parents=True, exist_ok=True)
@@ -568,8 +574,8 @@ def _synthetic_checkout_workflows_dir(tmp: Path) -> Path:
 """,
         encoding="utf-8",
     )
-    (wf / "secret-scan.yml").write_text(
-        """name: Secret Scan
+    (wf / "depth-1.yml").write_text(
+        """name: Depth One
 on:
   pull_request:
     branches: [main]
@@ -579,7 +585,7 @@ def _synthetic_checkout_workflows_dir(tmp: Path) -> Path:
     steps:
       - uses: actions/checkout@v4
         with:
-          fetch-depth: 0
+          fetch-depth: 1
 """,
         encoding="utf-8",
     )