From 7b8cc32fab7a693177554393e4a69263b1f1e7e7 Mon Sep 17 00:00:00 2001
From: Imani Pelton <imani.pelton@canonical.com>
Date: Tue, 23 Jun 2026 09:23:46 -0400
Subject: [PATCH 1/4] ci: test new secscan action

---
 .github/workflows/secscan-test.yaml | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)
 create mode 100644 .github/workflows/secscan-test.yaml

diff --git a/.github/workflows/secscan-test.yaml b/.github/workflows/secscan-test.yaml
new file mode 100644
index 0000000000..eaf5e1ece4
--- /dev/null
+++ b/.github/workflows/secscan-test.yaml
@@ -0,0 +1,17 @@
+name: Test secscan workflow
+on:
+  push:
+    branches:
+      - "main"
+      - "feature/*"
+      - "hotfix/*"
+      - "release/*"
+      - "renovate/*"
+  pull_request:
+
+jobs:
+  secscan:
+    runs-on: ubuntu
+    steps:
+      - name: Secscan
+        uses: canonical/starflow/secscan@work/secscan-action/CRAFT-5208

From faabf686298c7249525ef50bad6981810e8eaca5 Mon Sep 17 00:00:00 2001
From: Imani Pelton <imani.pelton@canonical.com>
Date: Tue, 23 Jun 2026 09:28:52 -0400
Subject: [PATCH 2/4] actually do this

---
 .github/workflows/secscan-test.yaml | 17 -----------------
 .github/workflows/spread.yml        |  7 +++++++
 2 files changed, 7 insertions(+), 17 deletions(-)
 delete mode 100644 .github/workflows/secscan-test.yaml

diff --git a/.github/workflows/secscan-test.yaml b/.github/workflows/secscan-test.yaml
deleted file mode 100644
index eaf5e1ece4..0000000000
--- a/.github/workflows/secscan-test.yaml
+++ /dev/null
@@ -1,17 +0,0 @@
-name: Test secscan workflow
-on:
-  push:
-    branches:
-      - "main"
-      - "feature/*"
-      - "hotfix/*"
-      - "release/*"
-      - "renovate/*"
-  pull_request:
-
-jobs:
-  secscan:
-    runs-on: ubuntu
-    steps:
-      - name: Secscan
-        uses: canonical/starflow/secscan@work/secscan-action/CRAFT-5208
diff --git a/.github/workflows/spread.yml b/.github/workflows/spread.yml
index 34c7460682..6abc2343f7 100644
--- a/.github/workflows/spread.yml
+++ b/.github/workflows/spread.yml
@@ -52,6 +52,13 @@ jobs:
         run: |
           sudo snap install --dangerous --classic ${{ steps.build-snapcraft.outputs.snap }}
 
+      - name: Secscan
+        uses: canonical/starflow/secscan@work/secscan-action/CRAFT-5208
+        with:
+          snap-file: ${{ steps.build-snapcraft.outputs.snap }}
+          cycle: 26.10
+          release-channel: edge
+
   integration-spread-tests:
     runs-on: [spread-installed]
     needs: build

From b50cde852c98c67eece55cfce13bac9191ab4968 Mon Sep 17 00:00:00 2001
From: Imani Pelton <imani.pelton@canonical.com>
Date: Tue, 23 Jun 2026 10:56:12 -0400
Subject: [PATCH 3/4] run on private runners

---
 .github/workflows/secscan.yml | 30 ++++++++++++++++++++++++++++++
 .github/workflows/spread.yml  |  7 -------
 2 files changed, 30 insertions(+), 7 deletions(-)
 create mode 100644 .github/workflows/secscan.yml

diff --git a/.github/workflows/secscan.yml b/.github/workflows/secscan.yml
new file mode 100644
index 0000000000..405476cd89
--- /dev/null
+++ b/.github/workflows/secscan.yml
@@ -0,0 +1,30 @@
+name: Security scan
+
+on:
+  pull_request:
+
+jobs:
+  secscan:
+    runs-on: [self-hosted]
+
+    steps:
+      - name: Checkout snapcraft
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+
+      # speed up build times by using wheels, when available
+      - name: Use wheels
+        run: |
+          yq eval 'del(.parts.snapcraft.build-environment[] | select(.UV_NO_BINARY == "true"))' -i snap/snapcraft.yaml
+
+      - name: Build snapcraft snap
+        id: build-snapcraft
+        uses: canonical/action-build@v1
+
+      - name: Secscan
+        uses: canonical/starflow/secscan@work/secscan-action/CRAFT-5208
+        with:
+          snap-file: ${{ steps.build-snapcraft.outputs.snap }}
+          cycle: 26.10
+          release-channel: edge
diff --git a/.github/workflows/spread.yml b/.github/workflows/spread.yml
index 6abc2343f7..34c7460682 100644
--- a/.github/workflows/spread.yml
+++ b/.github/workflows/spread.yml
@@ -52,13 +52,6 @@ jobs:
         run: |
           sudo snap install --dangerous --classic ${{ steps.build-snapcraft.outputs.snap }}
 
-      - name: Secscan
-        uses: canonical/starflow/secscan@work/secscan-action/CRAFT-5208
-        with:
-          snap-file: ${{ steps.build-snapcraft.outputs.snap }}
-          cycle: 26.10
-          release-channel: edge
-
   integration-spread-tests:
     runs-on: [spread-installed]
     needs: build

From 8b55943e49766ea297da7dbe3e2cfe007c9eceb5 Mon Sep 17 00:00:00 2001
From: Imani Pelton <imani.pelton@canonical.com>
Date: Tue, 23 Jun 2026 11:04:21 -0400
Subject: [PATCH 4/4] fix yamlism

---
 .github/workflows/secscan.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/secscan.yml b/.github/workflows/secscan.yml
index 405476cd89..fc70278b2d 100644
--- a/.github/workflows/secscan.yml
+++ b/.github/workflows/secscan.yml
@@ -26,5 +26,5 @@ jobs:
         uses: canonical/starflow/secscan@work/secscan-action/CRAFT-5208
         with:
           snap-file: ${{ steps.build-snapcraft.outputs.snap }}
-          cycle: 26.10
+          cycle: "26.10"
           release-channel: edge