ci(leak-scan): turn on the shared deny-list layer

[quadseven]

Why

This repo's leak scan runs the shared reusable with generic shapes only. Shapes cannot match a person, product or project name; those terms live in a shared SSM deny-list that is read at run time and never committed anywhere. The list and its read-only role now exist (infra#2997), and the shared scanner fix that reads the list one term per line and redacts every deny-list hit in the log (infra-public#106) is merged. This turns that layer on.

Summary

• The caller passes deny-list-ssm-param: /infra/leak-scan/deny-list, grants id-token: write on the job, and passes aws-role-arn: ${{ secrets.LEAK_SCAN_ROLE_ARN }}. The role can read that one parameter and nothing else, and trusts only pull_request runs.
• The uses: pin moves to the current infra-public main commit (2737550), which includes infra-public#106.
• Mode unchanged: enforce (the default). A finding fails the check.

Acceptance criteria

• This PR's own leak-scan run assumes the role and logs how many deny-list terms it loaded (the count only, never the terms)
• The leak-scan check passes on this PR
• The warn/enforce mode is unchanged

Out of scope

• Any change to the enforce/warn mode.
• The deny-list's contents, which never live in this repo.
• Fork PRs: they get no secrets, so the reusable fails closed there by design.

Size: XS

Part of #83

https://claude.ai/code/session_01Ht7JaVzv2aacJ9r6Srso9r

[grug-tribe]

Walkthrough

This PR upgrades the leak-scan workflow to pull a curated, externally-managed deny-list of sensitive terms (people, products, projects) from a secured SSM parameter at runtime via a restricted AWS role assumed through OIDC, rather than relying solely on the referenced reusable workflow's built-in generic-pattern detection; it grants id-token write permissions, pins a new reusable-workflow SHA, and wires up the deny-list SSM parameter path plus AWS role secret so forks run closed (no secrets) while trusted PRs gain redacted-hit coverage.

Review effort: quick (~5 min)

Changed files (1)

File	Summary	Changes
.github/workflows/check.leak-scan.yml	Pins reusable leak-scan workflow to a new SHA, adds id-token write permission, and passes deny-list SSM param plus AWS role secret for external deny-list loadin	+14/-1

Shape of the change

graph TD
  subgraph ".github"
    N0["check.leak-scan.yml"]
  end

Loading

Last walked at cc988c4610cf.