chore(guard): sync vendored public-repo-guard to canonical

[wave-av-release-bot]

Syncs the vendored public-repo-guard trio to the canonical source in wave-foundation/scaffolder/public-repo-guard.

• adds the internal-ip leak rule (Tailscale-CGNAT 100.64.0.0/10), lockstep with the pre-publish mirror gate
• reconciles accumulated drift in the vendored copy

Each changed file is byte-for-byte identical to canonical (verified by git blob SHA). The repo's own Secrets + content policy gate re-scans this PR.

🤖 Generated with Claude Code

---

Note

Update public-repo-guard workflow to use actions/checkout v7 without persisted credentials

Syncs public-repo-guard.yml to the canonical version. Upgrades actions/checkout from v5.0.1 to v7.0.0 and sets persist-credentials: false so the GITHUB_TOKEN is no longer stored in the repository's Git config after checkout.

^{Macroscope summarized ecfae45.}

---

Summary by cubic

Syncs the vendored public-repo-guard to the canonical wave-foundation/scaffolder/public-repo-guard, adding an internal-IP leak rule for Tailscale CGNAT (100.64.0.0/10) and reconciling drift. Updates the guard workflow to actions/checkout@v7 and sets persist-credentials: false to avoid exposing the job token during gitleaks scans.

^{Written for commit ecfae45. Summary will update on new commits.}

[greptile-apps]

PR author is in the excluded authors list.

[macroscopeapp]

Approvability

Verdict: Needs human review

Unable to check for correctness in ecfae45. The changes are minor CI/CD security hardening (updating checkout action, disabling credential persistence), but the author (a bot) does not own this workflow file. The designated owners (wave-av/sdk-owners) should review changes to their CI configuration.

^{You can customize Macroscope's approvability policy. Learn more.}

[devin-ai-integration]

Devin Review found 2 potential issues.

[devin-ai-integration]

🔍 Checkout pin bumped only in this workflow; rest of repo still on v4 / floating tags

This is now the only workflow pinned to a v7 commit SHA; .github/workflows/_checks.yml pins v4.3.1 by SHA and ~10 other workflows (e.g. .github/workflows/publish-npm.yml:30, .github/workflows/test-go.yml:31) still use the mutable actions/checkout@v4 tag without persist-credentials: false. If the intent is supply-chain hardening (zizmor artipacked), the same treatment is missing across those workflows, several of which are publish jobs with elevated permissions.

---

Was this helpful? React with 👍 or 👎 to provide feedback.

[devin-ai-integration]

🔍 Pinned commit SHA for v7.0.0 should be verified against upstream

The pin 9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 cannot be validated from the repo contents. Since this workflow is the repository's security gate, confirm the SHA actually corresponds to the actions/checkout v7.0.0 tag upstream — a wrong SHA either fails the job outright or silently runs a different revision than the comment claims.

---

Was this helpful? React with 👍 or 👎 to provide feedback.