fix(ci): provision real ripgrep for secret-scanner workflow checks

Verify PCRE2 on every hosted test platform and coverage runner. Preserve dependency PATH for real scanner delegates and report missing prerequisites explicitly, keeping production fail-closed behavior and hermetic missing/error controls intact.

.github/workflows/ci.yml

@@ -44,6 +44,36 @@ jobs:
         with:
           node-version: ${{ matrix.node }}
 
+      - name: Install and verify ripgrep (Linux)
+        if: runner.os == 'Linux'
+        shell: bash
+        run: |
+          sudo apt-get update
+          sudo apt-get install --no-install-recommends -y ripgrep
+          rg --version
+          printf 'ecc-pcre2-probe\n' | rg --pcre2 -- '^ecc-pcre2-probe$'
+
+      - name: Install and verify ripgrep (macOS)
+        if: runner.os == 'macOS'
+        shell: bash
+        run: |
+          if ! command -v rg >/dev/null 2>&1; then brew install ripgrep; fi
+          rg --version
+          printf 'ecc-pcre2-probe\n' | rg --pcre2 -- '^ecc-pcre2-probe$'
+
+      - name: Install and verify ripgrep (Windows)
+        if: runner.os == 'Windows'
+        shell: pwsh
+        run: |
+          if (-not (Get-Command rg -ErrorAction SilentlyContinue)) {
+            choco install ripgrep --yes --no-progress
+            if ($LASTEXITCODE -ne 0) { throw 'ripgrep installation failed' }
+          }
+          rg --version
+          if ($LASTEXITCODE -ne 0) { throw 'ripgrep executable is unavailable' }
+          'ecc-pcre2-probe' | rg --pcre2 -- '^ecc-pcre2-probe$'
+          if ($LASTEXITCODE -ne 0) { throw 'ripgrep PCRE2 support is required' }
+
       # Package manager setup
       - name: Setup pnpm
         if: matrix.pm == 'pnpm' && matrix.node != '18.x'
@@ -362,6 +392,13 @@ jobs:
       - name: Install dependencies
         run: npm ci --ignore-scripts
 
+      - name: Install and verify ripgrep
+        run: |
+          sudo apt-get update
+          sudo apt-get install --no-install-recommends -y ripgrep
+          rg --version
+          printf 'ecc-pcre2-probe\n' | rg --pcre2 -- '^ecc-pcre2-probe$'
+
       - name: Run coverage
         run: npm run coverage
 

tests/scripts/codex-hooks.test.js

@@ -193,13 +193,17 @@ git_path="$(command -v git)"
 awk_path="$(command -v awk)"
 head_path="$(command -v head)"
 cat_path="$(command -v cat)"
-rg_path="$(command -v rg || true)"
+rg_path="$(type -P rg || true)"
+${scanner === 'real' ? `if [[ -z "$rg_path" ]]; then
+printf 'Real scanner fixture requires ripgrep with PCRE2 support on PATH.\\n' >&2
+exit 97
+fi` : ''}
 git() { "$git_path" "$@"; }
 awk() { "$awk_path" "$@"; }
 head() { "$head_path" "$@"; }
 cat() { "$cat_path" "$@"; }
 unset -f rg
-PATH="${toBashPath(binDir)}"
+${scanner === 'real' ? '# Preserve dependencies used by an actual scanner executable or wrapper.' : `PATH="${toBashPath(binDir)}"`}
 ${scanner ? `rg() {
 printf '%s\\n' "$*" >> "${toBashPath(callsPath)}"
 ${scanner === 'real' ? '"$rg_path" "$@"' : scanner === 'finding' ? "printf '1:synthetic-scanner-finding\\n'; return 0;" : scanner === 'error' ? 'return 2;' : 'return 1;'}