mirror of
https://github.com/samvallad33/vestige.git
synced 2026-07-24 23:41:01 +02:00
02e0241aa2
Adds scripts/check-no-private-paths.sh and wires it into the existing guard workflow (runs on every push + PR). It fails if a real local filesystem path, personal username, or host name lands in the public repo — the class of leak just removed (e.g. /home/<user>/ worktree paths and a dev machine name). - Blocks exact private tokens and real-username home paths (/home/<x>/, /Users/<x>/, C:\Users\<x>\). - Allowlists the placeholder paths the docs legitimately use (/Users/you/..., ~/, etc.), so no false positives on the tree. - Verified: passes clean on the current tree; fails on a planted leak (token + real home path); placeholder paths pass. - CLAUDE.md hygiene section now points to both guards. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01B3RxH4JxAQYsuA9kFVnR5v
31 lines
959 B
YAML
31 lines
959 B
YAML
name: Guard — No Private Cloud Code
|
|
|
|
# Fails if private content ever lands in this public repo:
|
|
# 1. Private Vestige Cloud *service* code (billing, sync-key/namespace
|
|
# mapping, Lemon Squeezy webhooks, transactional email). The public cloud
|
|
# *client* is allowed and does not trip this.
|
|
# 2. Private local paths, usernames, or machine names (e.g. a real
|
|
# /home/<user>/ worktree). Placeholder paths like /Users/you/ are allowed.
|
|
on:
|
|
push:
|
|
branches: [main, feat/cloud-sync-mvp]
|
|
pull_request:
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
guard:
|
|
name: No private cloud service code
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v5
|
|
with:
|
|
fetch-depth: 0
|
|
|
|
- name: Scan for private cloud service markers
|
|
run: ./scripts/check-no-private-cloud.sh
|
|
|
|
- name: Scan for private paths, usernames, and machine names
|
|
run: ./scripts/check-no-private-paths.sh
|