chore(guard): sync vendored public-repo-guard to canonical - #74
chore(guard): sync vendored public-repo-guard to canonical#74wave-av-release-bot[bot] wants to merge 1 commit into
Conversation
|
PR author is in the excluded authors list. |
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | ||
| with: | ||
| # Checkout defaults to persisting the job token for later steps: since v6 it | ||
| # lives in a file under $RUNNER_TEMP referenced from .git/config, no longer in | ||
| # .git/config itself. It is still a live credential in the job, and this job | ||
| # downloads a third-party binary (gitleaks, below) and runs it over the whole | ||
| # tree. Nothing here pushes -- the scan is `--no-git` over the working tree -- | ||
| # so no step needs authenticated Git; drop it. (zizmor: artipacked) | ||
| persist-credentials: false |
There was a problem hiding this comment.
🔍 Checkout pin now inconsistent across workflows (v4/v6/v7)
This workflow is bumped to actions/checkout v7 while other workflows in the repo remain on older pins: .github/workflows/lint.yml:20 and .github/workflows/release.yml:44,81,166 use v6.0.3, and .github/workflows/_checks.yml:23,54,114 still use v4.3.1. Also, persist-credentials: false is only applied here — the same zizmor artipacked concern applies to the other checkout steps (release.yml jobs may genuinely need the token, but the lint/checks jobs likely do not). Worth a follow-up to unify pins and credential handling repo-wide.
Was this helpful? React with 👍 or 👎 to provide feedback.
ApprovabilityVerdict: Needs human review Unable to check for correctness in 73db3e0. Minor CI/CD security hardening (checkout action bump + credential persistence disabled), but the changed workflow file is owned by wave-av/core-team and the author does not have ownership, so designated owners should review. You can customize Macroscope's approvability policy. Learn more. |
Syncs the vendored
public-repo-guardtrio to the canonical source inwave-foundation/scaffolder/public-repo-guard.internal-ipleak rule (Tailscale-CGNAT100.64.0.0/10), lockstep with the pre-publish mirror gateEach changed file is byte-for-byte identical to canonical (verified by git blob SHA). The repo's own
Secrets + content policygate re-scans this PR.🤖 Generated with Claude Code
Summary by cubic
Synced the vendored
public-repo-guardto the canonical source to keep rules and policy in lockstep. Adds the internal‑ip leak rule for Tailscale CGNAT (100.64.0.0/10) to match the mirror gate.actions/checkoutto v7.0.0 and setpersist-credentials: falseto avoid a live token during thegitleaksscan.Written for commit 73db3e0. Summary will update on new commits.