[CI] issue: INFINIOPS-770 Update secret-scan container registry

[elkopel]

INFINIOPS-770

Description

Please provide a summary of the change.

What

Use the devops-stable secret-scan image from swx-storage.

Why ?

The previous secret-scan registry path is obsolete.

How ?

Update the image URL and tag in the CI matrix.

Change type

What kind of change does this PR introduce?

• Bugfix
• Feature
• Code style update
• Refactoring (no functional changes, no api changes)
• Build related changes
• [X ] CI related changes
• Documentation content changes
• Tests
• Other

Check list

• Code follows the style de facto guidelines of this project
• Comments have been inserted in hard to understand places
• Documentation has been updated (if necessary)
• Test has been added (if possible)

Summary by CodeRabbit

• Chores
  • Updated the secret scanning tool used during automated validation to use the current stable image source.
  • Preserved the existing architecture and execution settings, ensuring validation behavior remains consistent.

[coderabbitai]

📝 Walkthrough

Walkthrough

The CI matrix updates the secret-scan tool container from toolbox/secret_scan:0.0.27 to swx-storage/tools/secret_scan:devops-stable. Its architecture and category settings remain unchanged.

Changes

Secret Scan Image

Layer / File(s)	Summary
Update secret-scan container reference .ci/matrix_job.yaml	The secret-scan tool now uses the new registry path and stable image tag.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Poem

I’m a rabbit checking CI today,
The stable scan image leads the way.
Same arch and class, with a refreshed tag,
Secrets stay guarded in the build bag.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the CI change and the update to the secret-scan container registry.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Greptile Summary

This PR updates the CI matrix configuration to point the secret-scan step at the new registry path (swx-storage/tools/secret_scan:devops-stable), replacing the obsolete toolbox/secret_scan:0.0.27 location. No other CI steps or configuration are affected.

• The registry host path changes from toolbox/secret_scan to swx-storage/tools/secret_scan, reflecting the team's migration to the new storage location.
• The tag moves from the pinned 0.0.27 to the team-managed devops-stable floating tag.

Confidence Score: 5/5

• Minimal-risk CI-only change that swaps an obsolete image path for the team's current registry location.
• The change is a single-line registry URL update in CI configuration with no impact on library code or runtime behavior. The old path was explicitly called out as obsolete in the PR description, and the new path and tag appear to be the team's intentional replacement.
• No files require special attention.

Important Files Changed

Filename	Overview
.ci/matrix_job.yaml	Updates the secret-scan Docker image from the obsolete toolbox/secret_scan:0.0.27 path to swx-storage/tools/secret_scan:devops-stable. All other matrix entries are unchanged.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[CI Matrix Job] --> B{Image Source}
    B -- "Before (obsolete)" --> C["${registry_host}/toolbox/secret_scan:0.0.27"]
    B -- "After (updated)" --> D["${registry_host}/swx-storage/tools/secret_scan:devops-stable"]
    D --> E[Secret Scan Step]
    C --> E
    E --> F[CI Validation Complete]

Loading

_{Reviews (2): Last reviewed commit: "issue: 770 [CI] Update secret-scan conta..." | Re-trigger Greptile}

[greptile-apps]

Mutable floating tag reduces build reproducibility

The new tag devops-stable is a moving reference — any update to that image in the registry will silently change the behavior of the Secret Scan step without a corresponding change to this file. The previous pinned tag 0.0.27 ensured a specific, auditable image version was always pulled. If devops-stable is intentionally chosen by the team as a managed stable pointer, consider documenting that expectation; otherwise a pinned digest or explicit version tag would make CI behavior more predictable and easier to bisect on failures.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

[BennyItkin]

bot:rm:retest

[elkopel]

fail reason - missing redmine issue number.

[coderabbitai]

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.

[BennyItkin]

bot:retest