fix(rules): rule precision — WH006/WH013, harvested-registry, npx text, proof suites

[hyperpolymath]

Stacked on #875 (base fix/issue-sweep; GitHub retargets to main when #875 merges). Merge #875 first.

What

• WH006 skips reusable-workflow caller jobs (job-level uses:), where GitHub rejects timeout-minutes:. Refs standards#943.
• extract_job_blocks: the last job of every workflow was never checked (in-flight job not flushed), and later jobs reported the first job's line number. Both fixed. Expect WH006 to find a few more true positives estate-wide.
• WH013/WH002: git push <named non-origin remote> (gitlab/codeberg/backup mirrors) authenticates with its own key/token, so it doesn't need contents: write. Bare, origin and "$VAR" pushes still count. Refs standards#943.
• ScannerSuppression: harvested-registry/ is exempt for secret_detected only. Closes secret_detected flags harvested reference material: path-based carve-out needed for harvested-registry/ (from #746 sample) #865.
• npx_in_workflow message now recommends bunx/bun run (Deno banned 2026-09-22). Refs standards#938.
• honest_completion no_tests: a proof suite whose checker runs in CI counts as tests. Refs echo-types#271.

Verification (local)

• mix test: 1682 tests, 0 failures (242 excluded)
• mix compile --warnings-as-errors --force: clean
• Every change has fires / does-not-fire tests.

🤖 Generated with Claude Code

https://claude.ai/code/session_01QFphKkDVB9pUDSCD4bkz65

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: c1c779f8-76e3-44a4-9723-5bdfd14291d0

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[gitguardian]

⚠️ GitGuardian has uncovered 4 secrets following the scan of your pull request.

Please consider investigating the findings and remediating the incidents. Failure to do so may lead to compromising the associated services or software components.

🔎 Detected hardcoded secrets in your pull request

GitGuardian id	GitGuardian status	Secret	Commit	Filename
37657201	Triggered	Generic High Entropy Secret	b7a0e10	test/scanner_suppression_test.exs	View secret
37657201	Triggered	Generic High Entropy Secret	c892b80	test/scanner_suppression_test.exs	View secret
37657201	Triggered	Generic High Entropy Secret	065447f	test/scanner_suppression_test.exs	View secret
37657201	Triggered	Generic High Entropy Secret	8105f56	test/scanner_suppression_test.exs	View secret

🛠 Guidelines to remediate hardcoded secrets

1. Understand the implications of revoking this secret by investigating where it is used in your code.
2. Replace and store your secrets safely. Learn here the best practices.
3. Revoke and rotate these secrets.
4. If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.

To avoid such incidents in the future consider

• following these best practices for managing and storing secrets including API keys and other credentials
• install secret detection on pre-commit to catch secret before it leaves your machine and ease remediation.

---

^{🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.}