ci: add public-repo-guard (org leak gate)

[yakimoto]

Adds the org public-repo-guard CI gate (gitleaks + content-policy.sh) to this repo. Rules are fetched from the canonical wave-av/.github at runtime, so they stay centralized. Private-repo denylist comes from the org GUARD_PRIVATE_REPOS Actions variable.

Part of the org-wide pre-publication leak gate (wave-av/.github).

🤖 Generated with Claude Code

---

Summary by cubic

Adds a hardened, self-contained public-repo guard CI that scans the published tree for secrets and WAVE-internal content. Vendors .gitleaks.toml and scripts/public-repo-guard/content-policy.sh, pins and SHA-256 verifies gitleaks, and redacts matches for a deterministic gate mirroring the org canonical guard.

• New Features

  • Runs gitleaks on the published tree with local .gitleaks.toml (no history); pins v8.30.1 and verifies checksum.
  • Hardened .gitleaks.toml: adds .git/ metadata allowlist and placeholder/fixture allowlists to reduce false positives.
  • Adds scripts/public-repo-guard/content-policy.sh for WAVE-specific leaks (Stripe IDs/keys, Cloudflare account_id, private repo refs via vars.GUARD_PRIVATE_REPOS, absolute dev paths, committed .env) and extra keys gitleaks may miss (Anthropic, GitHub PAT, Supabase, AWS, private keys). Allowlist via # guard:allow <reason> and .guardignore.

• Dependencies

  • actions/checkout@v5, gitleaks v8.30.1 (version-pinned + SHA-256 verified), and ripgrep.

^{Written for commit bba8fd8. Summary will update on new commits.}

[changeset-bot]

⚠️ No Changeset found

Latest commit: bba8fd8

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[coderabbitai]

Warning

Review limit reached

@yakimoto, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 50 minutes and 11 seconds. Learn how PR review limits work.

Your organization has run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 4253d276-e9d0-4ba9-a9de-a3c969ef4437

📥 Commits

Reviewing files that changed from the base of the PR and between 52b2d7b and bba8fd8.

📒 Files selected for processing (3)

• .github/workflows/public-repo-guard.yml
• .gitleaks.toml
• scripts/public-repo-guard/content-policy.sh

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/add-public-repo-guard

✨ Simplify code

• Create PR with simplified code
• Commit simplified code in branch chore/add-public-repo-guard

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[cubic-dev-ai]

1 issue found across 1 file

Confidence score: 3/5

• There is a concrete medium-risk CI/security concern in .github/workflows/public-repo-guard.yml: guard rules/scripts are fetched from an unpinned main, which can change unexpectedly and make the gate non-deterministic.
• Given the 6/10 severity with high confidence (8/10), this is more than a minor housekeeping issue and could allow upstream regressions or tampering to affect merge decisions.
• Pay close attention to .github/workflows/public-repo-guard.yml - pin external guard references to immutable SHAs/tags to keep the CI gate deterministic and trustworthy.

Architecture diagram

sequenceDiagram
    participant GH as GitHub Actions
    participant Runner as Runner (ubuntu-latest)
    participant Checkout as Checkout Step
    participant CentralRepo as wave-av/.github (raw)
    participant GitleaksBin as gitleaks Release
    participant Gitleaks as gitleaks CL
    participant PolicyScript as content-policy.sh
    participant OrgVars as Org Variables

    GH->>Runner: Trigger workflow (PR / push / workflow_dispatch)
    Runner->>Checkout: actions/checkout@v5 (fetch-depth: 0)
    Checkout-->>Runner: Repository contents

    alt Local .gitleaks.toml missing
        Runner->>CentralRepo: curl canonical .gitleaks.toml
        CentralRepo-->>Runner: Saved as .gitleaks.toml
    end

    Runner->>GitleaksBin: Download gitleaks v8.30.1 binary
    GitleaksBin-->>Runner: Install /usr/local/bin/gitleaks

    Runner->>Gitleaks: gitleaks detect --no-git --source . --config .gitleaks.toml
    alt Secrets found
        Gitleaks-->>Runner: Exit code 1 (fail)
    else No secrets
        Gitleaks-->>Runner: Exit code 0
    end

    Runner->>CentralRepo: curl scripts/public-repo-guard/content-policy.sh
    CentralRepo-->>Runner: Script saved + chmod

    Runner->>OrgVars: Read GUARD_PRIVATE_REPOS variable
    OrgVars-->>Runner: Value passed via env

    Note over Runner,PolicyScript: Allowlisting via # guard:allow and .guardignore
    Runner->>PolicyScript: bash content-policy.sh . (with env)
    alt Content policy violation
        PolicyScript-->>Runner: Exit non-zero (fail)
    else All clear
        PolicyScript-->>Runner: Exit 0
    end

    alt Both checks pass
        Runner->>GH: Success
    else Any check fails
        Runner->>GH: Failure
    end

Loading

<sub>Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic</sub>

[cubic-dev-ai]

1 issue found across 3 files (changes from recent commits).

<sub>Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic</sub>

[greptile-apps]

This review was skipped because it would exceed your organization's monthly flex usage limit. Raise the limit in billing settings or wait until the next billing period resets limits.

[cubic-dev-ai]

1 issue found across 2 files (changes from recent commits).

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Fix all with cubic | Re-trigger cubic</sub>

[cubic-dev-ai]

1 issue found across 1 file (changes from recent commits).

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Fix all with cubic | Re-trigger cubic</sub>