From d52ec15d195d66443c9224326d54c83327be579b Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 9 Sep 2026 02:05:53 +0000 Subject: [PATCH] ci: add no-private-data check to scan PR commit messages Copies the no-private-data job from open-coder-ai/agentseam's ci.yml. It scans only the commits a pull request introduces (BASE_SHA..HEAD), never full history, so it does not fail on this repo's 83 pre-existing violations already on main. Co-Authored-By: Claude Opus 5 Signed-off-by: Claude --- .github/workflows/ci.yml | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 55b349e..6d56bb5 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -39,6 +39,36 @@ jobs: done < <(git rev-list --no-merges "$BASE_SHA..HEAD") exit "$missing" + # Commit messages and PR bodies are as public as the diff and much easier to leak + # into -- container paths, session identifiers, personal addresses. Checked here + # because the local test can only see the history it has. + no-private-data: + name: Scan commit messages for local or personal data + if: github.event_name == 'pull_request' + runs-on: ubuntu-latest + # Reads the PR's commits; writes nothing. + permissions: + contents: read + steps: + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + with: + persist-credentials: false + fetch-depth: 0 + - name: Scan commit messages for local or personal data + env: + BASE_SHA: ${{ github.event.pull_request.base.sha }} + run: | + pattern='/home/[A-Za-z0-9._-]+/|/Users/[A-Za-z0-9._-]+/|session_[0-9A-Za-z]{12,}|claude\.ai/code/session|/tmp/claude-[0-9]|@(gmail|yahoo|hotmail|outlook|protonmail)\.' + found=0 + while read -r sha; do + if git log -1 --format=%B "$sha" | grep -qiE "$pattern"; then + # Name the commit, never echo the match: a log line is a publication too. + echo "::error::commit $sha contains local or personal data in its message" + found=1 + fi + done < <(git rev-list --no-merges "$BASE_SHA..HEAD") + exit "$found" + check: name: Lint and test runs-on: ubuntu-latest