ci: add no-private-data check to scan PR commit messages - #127
Merged
Conversation
Copies the no-private-data job from open-coder-ai/agentseam's ci.yml. It scans only the commits a pull request introduces (BASE_SHA..HEAD), never full history, so it does not fail on this repo's 10 pre-existing violations already on main. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Signed-off-by: Claude <noreply@anthropic.com>
Appending the job to ci.yml took that file to 316 lines, seven over the repo's own 300-line review budget, and tests/test_repo_standards.py::test_no_file_exceeds_line_budget failed on all three Python versions. Its failure message asks for a split by activity rather than a bigger file, and figures.yml is already the precedent for exactly that, so the job moves to commit-hygiene.yml and ci.yml returns to 293 lines. The budget itself is untouched -- raising it would silence the check that caught this. The scan pattern is byte-identical to agentseam's, verified by comparison. Both workflows parse. The moved job still catches a leak: a throwaway commit carrying a synthetic match makes it exit 1 and name the commit without echoing the match, while the real commits exit 0. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Signed-off-by: Claude <noreply@anthropic.com>
jothimani-rajendran
marked this pull request as ready for review
September 9, 2026 10:40
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds the
no-private-datajob fromopen-coder-ai/agentseam's.github/workflows/ci.ymlto this repo, as a new.github/workflows/commit-hygiene.yml.What it does: on every pull request, it scans the commit messages of the commits the PR introduces for patterns that indicate local or personal data leaked into a message: absolute home-directory paths (
/home/...,/Users/...), session identifiers,claude.ai/code/sessionlinks,/tmp/claude-*paths, and personal email domains (gmail/yahoo/hotmail/outlook/protonmail). If a match is found it fails the build and names the offending commit SHA — it never echoes the matched text itself, since a log line is a publication too. The scan pattern is byte-identical to agentseam's, verified by direct comparison.Scope: it only scans
BASE_SHA..HEAD(excluding merge commits) — the commits a specific pull request adds — never the repository's full history. This repository has 10 pre-existing violations already onmain; a full-history scan would fail every build starting today. This job stops new leaks from landing; it does not attempt to clean up history that has already leaked.Why a separate workflow rather than a job in
ci.yml: the first revision of this PR appended the job toci.yml, which took that file to 316 lines and failedtests/test_repo_standards.py::test_no_file_exceeds_line_budgeton all three Python versions. That test's own failure message asks for a split by activity rather than a bigger file, andfigures.ymlis already the precedent, so the job lives incommit-hygiene.ymlandci.ymlreturns to 293 lines. The budget itself is untouched — raising it would have silenced the check that caught the mistake.The
actions/checkoutstep is pinned to3d3c42e5aac5ba805825da76410c181273ba90b1(tagv7), the pin this repo already uses everywhere else.Verified locally: the job's
run:block run against a throwaway commit carrying a synthetic match exits 1 and names the commit; run against the real commits it exits 0. Both workflows parse.tests/test_repo_standards.pypasses. Full suite: 1138 passed, 2 skipped, with the two knowntest_compiled_freshness/test_runtime_goldensfailures that reproduce on unmodifiedmainin this environment and pass in CI.🤖 Generated with Claude Code