ci: add no-private-data check to scan PR commit messages - #58
Merged
Conversation
Copies the no-private-data job from open-coder-ai/agentseam's ci.yml. It scans only the commits a pull request introduces (BASE_SHA..HEAD), never full history, so it does not fail on this repo's 83 pre-existing violations already on main. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Signed-off-by: Claude <noreply@anthropic.com>
jothimani-rajendran
marked this pull request as ready for review
September 9, 2026 10:41
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds the
no-private-datajob fromopen-coder-ai/agentseam's.github/workflows/ci.ymlto this repo's CI.What it does: on every pull request, it scans the commit messages of the commits the PR introduces for patterns that indicate local or personal data leaked into a message: absolute home-directory paths (
/home/...,/Users/...), session identifiers,claude.ai/code/sessionlinks,/tmp/claude-*paths, and personal email domains (gmail/yahoo/hotmail/outlook/protonmail). If a match is found it fails the build and names the offending commit SHA — it never echoes the matched text itself, since a log line is a publication too.Scope: it only scans
BASE_SHA..HEAD(excluding merge commits) — the commits a specific pull request adds — never the repository's full history. This repository has 83 pre-existing violations already onmain; a full-history scan would fail every build starting today. This job stops new leaks from landing; it does not attempt to clean up history that has already leaked.The
actions/checkoutstep is pinned to3d3c42e5aac5ba805825da76410c181273ba90b1(tagv7), the same pin this workflow already uses for every other job in the file.This repo's top-level
permissions:is{}and every job declares its own — unlike agentseam, chock and chock-catalog, which setpermissions: contents: readonce at the workflow level. To fit that convention the job here carries an explicitpermissions: contents: readand aname:(matching the siblingdcojob's style); theif:,runs-on:, steps and the scanning logic itself are unchanged from agentseam's job.Verified locally: the job's
run:block was run against a throwaway commit containing a synthetic match, correctly failing and naming the commit, and against the real change alone, passing cleanly.python -c "import yaml; yaml.safe_load(...)"confirms the workflow still parses.🤖 Generated with Claude Code