chore(guard): sync vendored public-repo-guard to canonical - #33
chore(guard): sync vendored public-repo-guard to canonical#33wave-av-release-bot[bot] wants to merge 1 commit into
Conversation
|
PR author is in the excluded authors list. |
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | ||
| with: | ||
| # Checkout defaults to persisting the job token for later steps: since v6 it | ||
| # lives in a file under $RUNNER_TEMP referenced from .git/config, no longer in | ||
| # .git/config itself. It is still a live credential in the job, and this job | ||
| # downloads a third-party binary (gitleaks, below) and runs it over the whole | ||
| # tree. Nothing here pushes -- the scan is `--no-git` over the working tree -- | ||
| # so no step needs authenticated Git; drop it. (zizmor: artipacked) | ||
| persist-credentials: false |
There was a problem hiding this comment.
🔍 Checkout pin now inconsistent with other workflows in the repo
This workflow is bumped to actions/checkout v7.0.0 while the other workflows still pin older versions (.github/workflows/_checks.yml:23,54,114 at v4.3.1, .github/workflows/shell-lint.yml:20 and .github/workflows/governance-enforce.yml:27 at v6.0.3). Those other checkouts also do not set persist-credentials: false, so the artipacked hardening applied here is only partial across the repo. Worth aligning pins and the hardening flag repo-wide in a follow-up.
Was this helpful? React with 👍 or 👎 to provide feedback.
ApprovabilityVerdict: Needs human review Unable to check for correctness in 9c500d0. This PR updates the checkout action and adds security hardening ( You can customize Macroscope's approvability policy. Learn more. |
Syncs the vendored
public-repo-guardtrio to the canonical source inwave-foundation/scaffolder/public-repo-guard.internal-ipleak rule (Tailscale-CGNAT100.64.0.0/10), lockstep with the pre-publish mirror gateEach changed file is byte-for-byte identical to canonical (verified by git blob SHA). The repo's own
Secrets + content policygate re-scans this PR.🤖 Generated with Claude Code
Summary by cubic
Synced the vendored
public-repo-guardwithwave-foundation/scaffolder/public-repo-guard. Adds an internal IP leak rule and hardens the guard workflow by upgradingactions/checkoutto v7 with no persisted credentials.New Features
100.64.0.0/10), matching the pre-publish mirror gate.Dependencies
actions/checkoutfrom v5.0.1 to v7.0.0 and setpersist-credentials: falseto avoid exposing the job token during the third-party scan.Written for commit 9c500d0. Summary will update on new commits.