dev → main: v0.2.0 release promotion #643
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: secret-scan | |
| on: | |
| pull_request: | |
| push: | |
| branches: [main, dev] | |
| schedule: | |
| - cron: "0 8 * * 1" # Mondays 08:00 UTC | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| jobs: | |
| local-agent-private-paths: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - name: Ensure local-only agent and skill paths are not tracked | |
| run: | | |
| set -euo pipefail | |
| blocked="$(git ls-files .context .agents .ai-context .agent-context .codex .local-skills .claude agent-instructions.local HANDOFF.md workdone-so-far.md || true)" | |
| if [ -n "$blocked" ]; then | |
| echo "::error::Local-only agent/skill paths must not be committed." | |
| printf '%s\n' "$blocked" | |
| exit 1 | |
| fi | |
| echo "No local-only agent/skill paths tracked." | |
| gitleaks: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| fetch-depth: 0 | |
| - name: Run gitleaks | |
| run: | | |
| GITLEAKS_VERSION=8.18.0 | |
| curl -sSLO "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" | |
| curl -sSLO "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_checksums.txt" | |
| grep " gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz$" "gitleaks_${GITLEAKS_VERSION}_checksums.txt" | sha256sum -c - | |
| tar xz -C /usr/local/bin -f "gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" gitleaks | |
| gitleaks detect --source . --config .gitleaks.toml -v | |
| forbidden-terms: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - name: Scan for forbidden internal terms | |
| run: | | |
| set -euo pipefail | |
| # Catch internal codenames and sensitive references in public files. | |
| # Exit non-zero if any hit lands in a public-facing path. | |
| # The pattern matches the various casings the internal term | |
| # appears in (with a space, dot, underscore, or dash). | |
| PATTERN='glasswing|project[ ._-]internal' | |
| if grep -RInE --include='*.md' --include='*.yml' --include='*.yaml' \ | |
| --include='*.json' --include='*.cast' --include='*.toml' \ | |
| --include='*.py' --include='*.go' --include='*.sh' \ | |
| --include='.gitignore' --include='.env*' --include='Dockerfile*' \ | |
| --include='Makefile*' \ | |
| --exclude-dir='.git' --exclude-dir='artifacts' --exclude-dir='.github' \ | |
| "${PATTERN}" .; then | |
| echo "::error::Found forbidden internal terms above. Redact before merging." | |
| exit 1 | |
| fi | |
| echo "No forbidden terms found." | |
| llm-model-names: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - name: Scan for specific LLM model identifiers | |
| run: | | |
| set -euo pipefail | |
| # Public surfaces should not name specific LLM model identifiers. | |
| # See CONTRIBUTING.md "No specific LLM model names in public | |
| # surfaces" for the rule. The pattern catches common | |
| # provider/version forms (claude-sonnet-4-5, gpt-5, | |
| # gemini-3.1-pro, llama-3.1-8b, kimi-k2, etc.). Product names | |
| # that happen to share an LLM brand (e.g. "Claude Code" the CLI | |
| # tool, when describing an integration target rather than a | |
| # model id) are NOT caught — those describe tools, not models. | |
| PATTERN='claude[- ](sonnet|opus|haiku|[0-9])|gpt[- ]?[0-9]|gemini[- ]?(pro|flash|nano|[0-9])|llama[- ]?[0-9]|sonnet[- ]?[0-9]|opus[- ]?[0-9]|kimi[- ]?[0-9]|moonshot[- ]?[0-9]|qwen[- ]?[0-9]|deepseek[- ](v|coder|chat|r|[0-9])|mistral[- ](large|medium|small|[0-9])|haiku[- ]?[0-9]' | |
| if grep -RInE --include='*.md' --include='*.yml' --include='*.yaml' \ | |
| --include='*.json' --include='*.cast' --include='*.toml' \ | |
| --include='*.py' --include='*.go' --include='*.sh' \ | |
| --include='Dockerfile*' \ | |
| --exclude-dir='.git' --exclude-dir='artifacts' --exclude-dir='.github' \ | |
| --exclude-dir='node_modules' \ | |
| --exclude-dir='adversarial' --exclude-dir='advanced' --exclude-dir='test-results' \ | |
| --exclude='run_adversarial_suite.py' \ | |
| -i "${PATTERN}" .; then | |
| echo "::error::Found specific LLM model names above. Use generic phrasing or env-var-driven config; see CONTRIBUTING.md." | |
| exit 1 | |
| fi | |
| echo "No specific LLM model names found." |