|
| 1 | +name: guard |
| 2 | +on: |
| 3 | + pull_request: |
| 4 | + push: |
| 5 | + branches: [main] |
| 6 | + |
| 7 | +jobs: |
| 8 | + guard: |
| 9 | + runs-on: ubuntu-latest |
| 10 | + steps: |
| 11 | + - uses: actions/checkout@v4 |
| 12 | + with: |
| 13 | + fetch-depth: 0 |
| 14 | + |
| 15 | + - name: Moat-term denylist |
| 16 | + shell: bash |
| 17 | + run: | |
| 18 | + set -euo pipefail |
| 19 | + # Case-insensitive. Block the SECRET PHRASES, not common words. |
| 20 | + # Deliberately NOT bare 'ledger' (every accounting repo says ledger), |
| 21 | + # NOT bare 'patent' (the Apache-2.0 LICENSE has a patent-grant clause), |
| 22 | + # NOT bare 'spark' (Apache Spark / the word). The moat is fully covered |
| 23 | + # by the specific multi-word phrases + the unambiguous project names. |
| 24 | + DENY='distillation|distill|teacher[ _-]?model|student[ _-]?model|\blora\b|inference[_-]?traces?|de[_-]?identif|\bde[_-]?id\b|parallel[_-]?write|parallel[_-]?ledger|shadow[_-]?ledger|owned[_-]?ledger|second[_-]?ledger|data[_-]?moat|\bmoat\b|signalstore|\bqwen\b|\bdgx\b|patent[ _-]?pending|patent[ _-]?core|patentable' |
| 25 | +
|
| 26 | + if [ "${{ github.event_name }}" = "pull_request" ]; then |
| 27 | + git fetch origin "${{ github.base_ref }}" --depth=1 |
| 28 | + RANGE="origin/${{ github.base_ref }}...HEAD" |
| 29 | + echo "Scanning PR diff range: $RANGE" |
| 30 | + HITS=$(git diff "$RANGE" | grep -nEi "^\+" | grep -Ei "$DENY" || true) |
| 31 | + else |
| 32 | + echo "Scanning full tree on push" |
| 33 | + HITS=$(grep -rEinI "$DENY" . --exclude-dir=.git --exclude=guard.yml --exclude='LICENSE*' --exclude='NOTICE*' --exclude='COPYING*' || true) |
| 34 | + fi |
| 35 | +
|
| 36 | + if [ -n "$HITS" ]; then |
| 37 | + echo "::error::Denylisted moat/private term detected. Failing." |
| 38 | + echo "$HITS" |
| 39 | + exit 1 |
| 40 | + fi |
| 41 | + echo "Moat denylist clean." |
| 42 | +
|
| 43 | + - name: Secret-pattern scan |
| 44 | + shell: bash |
| 45 | + run: | |
| 46 | + set -euo pipefail |
| 47 | + # Obvious private-key / token shapes. Tune as needed. |
| 48 | + SECRETS='BEGIN (RSA|EC|OPENSSH|PGP) PRIVATE KEY|AKIA[0-9A-Z]{16}|xox[baprs]-[0-9A-Za-z-]+|gh[pousr]_[0-9A-Za-z]{36,}|-----BEGIN PRIVATE KEY-----|sk-[A-Za-z0-9]{20,}' |
| 49 | + HITS=$(grep -rEnI "$SECRETS" . --exclude-dir=.git --exclude=guard.yml || true) |
| 50 | + if [ -n "$HITS" ]; then |
| 51 | + echo "::error::Possible secret detected. Failing." |
| 52 | + echo "$HITS" |
| 53 | + exit 1 |
| 54 | + fi |
| 55 | + echo "Secret scan clean." |
0 commit comments