Fix privacy guard enforcement parity - #8
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
BunsDev
changed the title
c42c76f to
516e327
Compare
There was a problem hiding this comment.
Pull request overview
This PR tightens “privacy guard” enforcement so local hooks and CI use the same baseline-aware gitleaks strategy (including default rules), pins the gitleaks version via a checked-in .gitleaks-version, centralizes shell privacy patterns, and prevents unguarded Beads Dolt sync commands from appearing in tracked agent-instruction files.
Changes:
- Route both local hooks and CI through
scripts/guard-scan.shfor baseline-aware gitleaks scanning, including a separate default-rules-only pass. - Pin and enforce the gitleaks version across local and CI using
.gitleaks-version. - Centralize pattern/marker definitions in
scripts/privacy-patterns.shand add a policy test + instruction-surface guard for barebd dolt push.
Reviewed changes
Copilot reviewed 12 out of 12 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
vitest.config.ts |
Excludes the new node-based guard policy test from Vitest discovery. |
SECURITY.md |
Documents the new enforcement layering (default-rule pass, baseline-aware parity, version pin, centralized patterns). |
scripts/privacy-patterns.sh |
Adds shared regex/marker constants for local guard + CI PR-diff scanning. |
scripts/guard-scan.sh |
Enforces pinned gitleaks version and runs both Coven rules + default rules; sources shared patterns. |
scripts/guard-policy.test.mjs |
Adds node:test coverage for guard parity, version pinning, pattern sharing, and instruction sync policy. |
scripts/check-instruction-sync.sh |
Fails if instruction surfaces include executable bd dolt push guidance. |
package.json |
Adds test:guard and check:instruction-sync; wires them into pnpm check. |
AGENTS.md |
Replaces bare bd dolt push guidance with scripts/bd-dolt-push.sh. |
.gitleaks-version |
Introduces the pinned gitleaks version used by both local guard and CI. |
.gitleaks-default.toml |
Adds a default-rules-only gitleaks config for the second pass. |
.github/workflows/privacy-guard.yml |
Installs gitleaks based on .gitleaks-version and delegates scanning to scripts/guard-scan.sh; sources shared patterns for PR diff scan. |
.beads/interactions.jsonl |
Records bead status/history updates related to the work. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
|
Maintainer review: still blocked before merge. The branch conflicts with current main, and the two existing Copilot findings are actionable: normalize |
…lockers # Conflicts: # package.json # vitest.config.ts
Summary
Verification
pnpm check./scripts/guard-scan.sh --stagedgit diff --checkDraft while maintainer review is pending.