Scope patches commit provenance exception - #28

LLM Description written by Codex:GPT-6

The required audit for SocketDev/depscan#26088 fails because its repository token cannot inspect private Patchpedia commit ancestry. Apply the approved impostor-commit exception only to three patches workflows, without requiring a PR-bot key or changing the audit for other inputs.

When running in depscan with .github/zizmor-patches.yml present, scan a temporary copy of the complete .github tree with the three patches workflows removed, then scan those original files using the explicit exception config. Both scans run and either failure fails the job. Root audit configuration is copied for the normal scan; composite actions and Dependabot remain covered. Other repositories, and depscan revisions without the exception config, retain the original scan.

The exception applies to deploy-patches-staging.yaml, deploy-patches-prod.yaml, and patches-compatibility.yaml. Their config in depscan preserves existing repository policy and additionally disables impostor-commit. This omits provenance checks for all action references in those three files, not only Patchpedia. All other rules retain existing policy, and other inputs retain provenance checks. SHA pins and deployment validation remain unchanged.

No App-token step, App-secret warning exception, repository write permission, audit-wide suppression or offline audit mode is introduced.

Validation

• Actionlint passes; zizmor 1.23.1 offline audit of this workflow passes.
• Five real-CLI/real-filesystem cases passed using the exact shell step: clean scan, finding in a selected workflow, finding in an ordinary workflow, other repository fallback, and absent-config fallback. Workflow, composite-action and Dependabot coverage verified; findings fail the job in either partition. These local checks used offline mode only to avoid network credentials; the committed workflow retains online auditing.
• The three actual depscan workflows pass a local offline scan with their explicit config. Parsed config comparison confirms the only change from existing policy is impostor-commit: disable: true.
• Yamllint passes with a 120-column limit and existing baseline warnings; git diff --check passes. Independent review approved the partition and failure propagation.

Enablement

Merge this central workflow change and ensure depscan contains its scoped config, then trigger a fresh required audit on depscan#26088. The exception does not take effect before both are present. Reusable-workflow sharing remains a separate prerequisite. No credentials or repository settings were changed.