|
| 1 | +name: Privacy Guard |
| 2 | + |
| 3 | +on: |
| 4 | + pull_request: |
| 5 | + push: |
| 6 | + branches: [main] |
| 7 | + workflow_dispatch: |
| 8 | + |
| 9 | +permissions: |
| 10 | + contents: read |
| 11 | + |
| 12 | +jobs: |
| 13 | + scan: |
| 14 | + runs-on: ubuntu-latest |
| 15 | + |
| 16 | + steps: |
| 17 | + - name: Checkout |
| 18 | + uses: actions/checkout@v4 |
| 19 | + |
| 20 | + - name: Ensure sensitive local settings are not tracked |
| 21 | + shell: bash |
| 22 | + run: | |
| 23 | + set -euo pipefail |
| 24 | + if git ls-files --error-unmatch config/settings.json >/dev/null 2>&1; then |
| 25 | + echo "❌ config/settings.json must never be tracked" |
| 26 | + exit 1 |
| 27 | + fi |
| 28 | +
|
| 29 | + - name: Ensure build spec does not bundle config directory |
| 30 | + shell: bash |
| 31 | + run: | |
| 32 | + set -euo pipefail |
| 33 | + if grep -q "('config', 'config')" VinylFlow.spec; then |
| 34 | + echo "❌ VinylFlow.spec must not bundle config directory" |
| 35 | + exit 1 |
| 36 | + fi |
| 37 | +
|
| 38 | + - name: Scan tracked text files for personal data patterns |
| 39 | + shell: bash |
| 40 | + run: | |
| 41 | + set -euo pipefail |
| 42 | + python - <<'PY' |
| 43 | + import pathlib |
| 44 | + import re |
| 45 | + import subprocess |
| 46 | + import sys |
| 47 | +
|
| 48 | + tracked = subprocess.check_output(["git", "ls-files"], text=True).splitlines() |
| 49 | +
|
| 50 | + patterns = [ |
| 51 | + ( |
| 52 | + "Hardcoded Discogs token", |
| 53 | + re.compile(r"DISCOGS_USER_TOKEN\s*[:=]\s*['\"]?(?!your_token_here\b)[A-Za-z0-9]{20,}") |
| 54 | + ), |
| 55 | + ( |
| 56 | + "macOS personal user path", |
| 57 | + re.compile(r"/Users/(?!you\b)[A-Za-z0-9._-]+") |
| 58 | + ), |
| 59 | + ( |
| 60 | + "Windows personal user path", |
| 61 | + re.compile(r"C:\\\\Users\\\\(?!you\b)[A-Za-z0-9._-]+") |
| 62 | + ), |
| 63 | + ] |
| 64 | +
|
| 65 | + allowed_files = { |
| 66 | + ".env.example", |
| 67 | + } |
| 68 | +
|
| 69 | + failures = [] |
| 70 | + for rel in tracked: |
| 71 | + if rel in allowed_files: |
| 72 | + continue |
| 73 | + p = pathlib.Path(rel) |
| 74 | + if not p.exists() or p.is_dir(): |
| 75 | + continue |
| 76 | +
|
| 77 | + try: |
| 78 | + text = p.read_text(encoding="utf-8") |
| 79 | + except Exception: |
| 80 | + continue |
| 81 | +
|
| 82 | + for name, regex in patterns: |
| 83 | + for m in regex.finditer(text): |
| 84 | + line = text.count("\n", 0, m.start()) + 1 |
| 85 | + failures.append((rel, line, name, m.group(0)[:200])) |
| 86 | +
|
| 87 | + if failures: |
| 88 | + print("❌ Privacy guard found potential leaks:") |
| 89 | + for rel, line, name, snippet in failures: |
| 90 | + print(f"- {rel}:{line}: {name}: {snippet}") |
| 91 | + sys.exit(1) |
| 92 | +
|
| 93 | + print("✅ Privacy guard passed") |
| 94 | + PY |
0 commit comments