chore(guard): sync vendored public-repo-guard to canonical

[wave-av-release-bot]

Syncs the vendored public-repo-guard trio to the canonical source in wave-foundation/scaffolder/public-repo-guard.

• adds the internal-ip leak rule (Tailscale-CGNAT 100.64.0.0/10), lockstep with the pre-publish mirror gate
• reconciles accumulated drift in the vendored copy

Each changed file is byte-for-byte identical to canonical (verified by git blob SHA). The repo's own Secrets + content policy gate re-scans this PR.

🤖 Generated with Claude Code

---

Note

Update public-repo-guard workflow to use actions/checkout v7 without persisted credentials

Syncs public-repo-guard.yml to the canonical version. Upgrades actions/checkout from v5.0.1 to v7.0.0 and sets persist-credentials: false so the GITHUB_TOKEN is no longer stored in the repository's Git config after checkout.

^{Macroscope summarized a81a4bd.}

---

Summary by cubic

Syncs the vendored public-repo-guard with the canonical source to remove drift and tighten leak detection. Adds an internal IP leak rule and hardens the workflow by updating actions/checkout and disabling token persistence.

• New Features

  • Add internal IP leak rule for Tailscale CGNAT range 100.64.0.0/10.

• Dependencies

  • Bump actions/checkout to v7.0.0.
  • Set persist-credentials: false to avoid exposing the job token during the gitleaks scan.

^{Written for commit a81a4bd. Summary will update on new commits.}

[greptile-apps]

PR author is in the excluded authors list.

[macroscopeapp]

Approvability

Verdict: Needs human review

Unable to check for correctness in a81a4bd. This PR updates the checkout action version and adds security hardening (persist-credentials: false) to a CI workflow. While the changes are low-risk, the modified file is owned by wave-av/core-team and the author (a bot) is not a designated owner, so review by the code owners is appropriate.

^{You can customize Macroscope's approvability policy. Learn more.}

[devin-ai-integration]

Devin Review found 1 potential issue.

[devin-ai-integration]

🔍 Checkout action versions now diverge across workflows

This workflow moves to actions/checkout@9c091bb… (v7.0.0) while the rest of the repo pins other versions: v6.0.3 in .github/workflows/lint.yml:16 and .github/workflows/release.yml:41,77,131, and v4.3.1 in .github/workflows/_checks.yml:23,54,114. Also, persist-credentials: false is only applied here — the other workflows still persist the job token, so the artipacked hardening the comment describes is only partially rolled out. Worth confirming whether the intent was to standardize all workflows.

---

Was this helpful? React with 👍 or 👎 to provide feedback.