chore(guard): sync vendored public-repo-guard to canonical - #38
wave-av-release-bot[bot] wants to merge 1 commit into
Conversation
|
PR author is in the excluded authors list. |
ApprovabilityVerdict: Needs human review Unable to check for correctness in 93d5ddc. This CI workflow update (checkout action version bump and security hardening) is low-risk, but the file is owned by wave-av/streaming-team and the author (a bot) is not a designated owner. The team should verify this vendored sync is appropriate. You can customize Macroscope's approvability policy. Learn more. |
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
| with: | ||
| # Checkout defaults to persisting the job token for later steps: since v6 it | ||
| # lives in a file under $RUNNER_TEMP referenced from .git/config, no longer in | ||
| # .git/config itself. It is still a live credential in the job, and this job | ||
| # downloads a third-party binary (gitleaks, below) and runs it over the whole | ||
| # tree. Nothing here pushes -- the scan is `--no-git` over the working tree -- | ||
| # so no step needs authenticated Git; drop it. (zizmor: artipacked) | ||
| persist-credentials: false |
There was a problem hiding this comment.
🔍 persist-credentials: false is safe for this job's steps
I verified no subsequent step in this job needs authenticated Git: the scan runs gitleaks detect --no-git --source . and the policy script scripts/public-repo-guard/content-policy.sh operates on the working tree only, with no git fetch/push or GH API calls. Disabling credential persistence therefore does not break the gate. Worth confirming the pinned SHA 9c091bb... actually corresponds to the v7.0.0 tag, since a mismatched comment/SHA pair is only detectable out-of-band.
Was this helpful? React with 👍 or 👎 to provide feedback.
Syncs the vendored
public-repo-guardtrio to the canonical source inwave-foundation/scaffolder/public-repo-guard.internal-ipleak rule (Tailscale-CGNAT100.64.0.0/10), lockstep with the pre-publish mirror gateEach changed file is byte-for-byte identical to canonical (verified by git blob SHA). The repo's own
Secrets + content policygate re-scans this PR.🤖 Generated with Claude Code
Note
Update
public-repo-guardworkflow to useactions/checkoutv7 without persisted credentialsSyncs public-repo-guard.yml to the canonical version. Upgrades
actions/checkoutfrom v5.0.1 to v7.0.0 and setspersist-credentials: falseso theGITHUB_TOKENis no longer stored in the repository's Git config after checkout.Macroscope summarized 93d5ddc.
Summary by cubic
Syncs the vendored
public-repo-guardto the canonicalwave-foundation/scaffolder/public-repo-guardto remove drift and add theinternal-ipleak rule for Tailscale CGNAT (100.64.0.0/10). Also hardens the scan workflow by upgradingactions/checkoutand disabling credential persistence.actions/checkoutto v7.0.0.persist-credentials: falsesince the job only runsgitleakson the working tree and does not push.Written for commit 93d5ddc. Summary will update on new commits.