ci: add no-private-data check to scan PR commit messages

.github/workflows/ci.yml

@@ -39,6 +39,36 @@ jobs:
           done < <(git rev-list --no-merges "$BASE_SHA..HEAD")
           exit "$missing"
 
+  # Commit messages and PR bodies are as public as the diff and much easier to leak
+  # into -- container paths, session identifiers, personal addresses. Checked here
+  # because the local test can only see the history it has.
+  no-private-data:
+    name: Scan commit messages for local or personal data
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    # Reads the PR's commits; writes nothing.
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
+        with:
+          persist-credentials: false
+          fetch-depth: 0
+      - name: Scan commit messages for local or personal data
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+        run: |
+          pattern='/home/[A-Za-z0-9._-]+/|/Users/[A-Za-z0-9._-]+/|session_[0-9A-Za-z]{12,}|claude\.ai/code/session|/tmp/claude-[0-9]|@(gmail|yahoo|hotmail|outlook|protonmail)\.'
+          found=0
+          while read -r sha; do
+            if git log -1 --format=%B "$sha" | grep -qiE "$pattern"; then
+              # Name the commit, never echo the match: a log line is a publication too.
+              echo "::error::commit $sha contains local or personal data in its message"
+              found=1
+            fi
+          done < <(git rev-list --no-merges "$BASE_SHA..HEAD")
+          exit "$found"
+
   check:
     name: Lint and test
     runs-on: ubuntu-latest