ci: scan issue and comment bodies — this repo has never scanned one

[yakimoto]

User description

This repo's public-repo-guard has never scanned a single issue or comment body.

Measured across all 28 public wave-av repos (wave-av/claude-workstation#1747, #1794): two coverage shapes satisfy the one required check name Secrets + content policy.

repos	triggers	jobs
27	pull_request, push, workflow_dispatch	guard
1	+ issues, issue_comment	+ body-guard

This repo is in the 27. All 28 report the same green check — because a required check asserts that something named X passed, never what X examined.

The outlier is wave-moq-edge, and its own comment says why it matters:

edited matters as much as opened: a body can be made to leak long after the PR is first raised, and until this workflow covered it, nothing ever re-scanned.

That gap was not theoretical there: a PR was blocked for naming a private repo in wrangler.toml while the very same name, with more operational detail attached, sat unchallenged in its body.

What lands

Three files — the bundle the workflow's own header names, minus what this repo already has (.gitleaks.toml and content-policy.sh are already vendored, and are checked as prerequisites; a repo missing either is refused rather than half-installed):

.github/workflows/public-repo-guard.yml               replaced (72 -> 163 lines)
scripts/public-repo-guard/body-policy.sh              new, mode 100755
scripts/public-repo-guard/tests/body-policy.test.sh   new, mode 100755

The workflow's header names four files as the install unit but executes a fifth — tests/body-policy.test.sh, in its own self-test step. Omitting it installs a workflow that fails on a step nobody read, so the manifest ships it. Modes are preserved via the git trees API; the contents API creates 100644 regardless, which would silently break running these scripts as executables.

Planned by governance/lib/vendor-bundle.mjs (claude-workstation#1850) against a checked-in manifest, not by ad-hoc shell.

One deliberate divergence from the reference, stated rather than silent

The shipped workflow is wave-moq-edge's with actions/checkout bumped from v5.0.1 to v7.0.1 (3d3c42e5aac5ba805825da76410c181273ba90b1), the pin already used by claude-workstation's own gate.

Copying verbatim was checked first and rejected on evidence: of the 18 target repos, 17 carry a byte-identical guard, and wave-realtime-edge already runs v7.0.0 — so a verbatim copy would have downgraded it, and shipped a stale pin to the other 17. A separate PR brings the reference itself up to the same pin.

Honest about what this can and cannot do

On a PR this PREVENTS the merge. On an issue or comment the text is already public the moment it posts, so this is DETECTION: it says go redact, fast. Only a client-side pre-write hook stops that class before publication.

Also inherited from the reference: concurrency moves from workflow-level to per job, because the two jobs want opposite behaviour. A workflow-level group forced one policy on both, and rapid body edits cancelled the tree job repeatedly — every cancelled check-run stays attached to the commit, so the PR reported UNSTABLE while the live runs were green.

The body gate ships with its own fixtures and runs them in CI. Its negative cases are the load-bearing half: a leak gate that blocks legitimate cross-repo references gets switched off, and then it protects nothing.

Refs wave-av/claude-workstation#1747.

Note

Medium Risk
Changes required-status CI behavior and merge gating on PR text; misconfigured GUARD_PRIVATE_REPOS or scanner failures fail closed and can block merges until fixed.

Overview
Closes a gap where only the published tree was scanned — PR/issue/comment/review text is now checked server-side via a new body-policy.sh and a separate public-repo-guard-body.yml workflow that materializes event payloads safely and runs the policy on titles/bodies (including edited events).

The tree workflow is reworked so the required "Secrets + content policy" check no longer runs (or publishes skipped) on comment/review events — a file-level split that fixes branch-protection masking when skipped runs overwrote real failures. The tree job also gains merge_group, per-job concurrency, actions/checkout v7.0.1, persist-credentials: false, and a pinned PCRE2 ripgrep install (replacing apt rg that broke -P rules). Fixture tests for body policy run from the tree job in CI.

body-policy.sh mirrors many tree leak rules but tunes them for prose (e.g. private-repo names only block when paired with operational detail on the same line, redacted annotations, fail-closed on scanner/empty GUARD_PRIVATE_REPOS in CI). body-policy.test.sh adds must-block, must-pass, and fail-closed coverage.

^{Reviewed by Cursor Bugbot for commit 882e965. Bugbot is set up for automated code reviews on this repo. Configure here.}

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is enabled.}

Note

Scan PR/issue/comment/review bodies for credential and infrastructure leaks in CI

• Adds body-policy.sh, a new Bash scanner that checks materialized PR/issue/comment/review text for credential formats (Stripe, Anthropic, GitHub PATs, AWS keys, PEM headers) and private repo name proximity to operational keywords.
• Adds a new body-guard CI job in public-repo-guard.yml triggered by issues, issue_comment, pull_request_review, and pull_request_review_comment events, with per-event concurrency keyed to the most specific object ID.
• Expands the existing guard job triggers to include review events and body-policy fixture tests; adds PCRE2-capable ripgrep installation to prevent false scanner failures.
• Adds body-policy.test.sh covering must-block, must-pass, and fail-closed fixture cases.
• Risk: the scanner fails closed (exit 2) when GUARD_PRIVATE_REPOS is unset in CI or when a non-PCRE2 rg is detected, blocking the check run.

^{Macroscope summarized c284c89.}

Summary by Sourcery

Expand the public repository guard to scan all public conversation text while preserving reliable, merge-blocking tree checks.

New Features:

• Add CI coverage for scanning pull request, issue, comment, and review text for exposed credentials and internal infrastructure details.
• Introduce body-policy fixtures covering blocking detections, allowed references, redacted findings, and fail-closed behavior.

Bug Fixes:

• Prevent review and comment events from masking or bypassing the required published-tree security check.

Enhancements:

• Apply separate concurrency policies for tree scans and body scans so rapid updates do not discard required verdicts or body coverage.
• Make body scanning safer and more precise by materializing untrusted event text without shell interpolation, allowing ordinary cross-repository references, and failing closed on missing configuration or scanner errors.

Build:

• Pin and checksum-verify a PCRE2-capable ripgrep binary for policy scans.
• Upgrade the workflow checkout action to v7.0.1.

CI:

• Add a dedicated body-guard workflow for pull request, issue, comment, and review events, including edits.
• Run body-policy fixture tests as part of the existing repository guard workflow.

Tests:

• Add comprehensive body-policy tests for secret formats, infrastructure identifiers, private-repository operational detail, allowlists, false-positive protections, and failure handling.

---

CodeAnt-AI Description

Scan public PR, issue, and comment text for internal leaks

What Changed

• Added a body-content scan for pull request titles and bodies, issue text, comments, inline review comments, and submitted reviews
• Blocks exposed credentials, private infrastructure details, operator file paths, internal-only markers, and private repository names paired with operational details
• Re-scans edited content and keeps each event’s verdict separate so body checks cannot mask the required source-tree scan
• Fails closed when scanning tools, event data, or private-repository configuration is missing or broken, without printing matched secrets in workflow logs
• Added fixture coverage for detected leaks, safe documentation references, allowlisted examples, configuration formats, and scanner failures
• Keeps the required tree scan limited to tree-changing events and adds merge-queue coverage

Impact

✅ Fewer internal leaks in public PRs and discussions
✅ Edited comments and reviews are rescanned
✅ Required tree-scan results cannot be masked by skipped body events

💡 Usage Guide

Checking Your Pull Request

Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.

Talking to CodeAnt AI

Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:

@codeant-ai ask: Your question here

This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.

Example

@codeant-ai ask: Can you suggest a safer alternative to storing this secret?

Preserve Org Learnings with CodeAnt

You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:

@codeant-ai: Your feedback here

This helps CodeAnt AI learn and adapt to your team's coding style and standards.

Example

@codeant-ai: Do not flag unused imports.

Retrigger review

Ask CodeAnt AI to review the PR again, by typing:

@codeant-ai: review

Check Your Repository Health

To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.

[coderabbitai]

Important

Review skipped

Auto reviews are limited based on label configuration.

🚫 Excluded labels (none allowed) (1)

• rr:skip-coderabbit

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Team

Run ID: b7daa9f1-b6dd-4b5c-a509-28612ac06ea7

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_31b04dac-ddcf-4755-b62e-bd5e19d92c8d)

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This PR adds a substantial security-sensitive CI gate that scans public conversation content and can block merges, while also changing required-check and merge-queue behavior. Unresolved comments raise a possible scanner bypass and an installation/event-lifecycle failure mode, so the workflow and policy behavior need human review.

Not approved because:

• Credit balance exhausted. Approvability relies on correctness review in order to determine eligibility

^{Review your spending limits in Billing settings. You can add or adjust custom eligibility rules. Learn more.}

[qodo-code-review]

PR Summary by Qodo

CI: scan issue/PR/comment bodies in public-repo-guard (with fixtures + safe concurrency)

✨ Enhancement ⚙️ Configuration changes 🧪 Tests 🕐 40+ Minutes

AI Description

• Add a dedicated body-scanning job for PR/issue/comment text, including edited events.
• Introduce a fail-closed body policy script with allowlists and redacted reporting.
• Add fixture-only self-tests and per-job concurrency to prevent unstable/cancelled checks.

Diagram

graph TD
  E(["GitHub events\nPR / issues / comments"]) --> W["public-repo-guard workflow"] --> J1["Job: guard (tree)"] --> S1["content-policy.sh"]
  W --> J2["Job: body-guard"] --> M["Materialize body.txt"] --> S2["body-policy.sh"]
  J1 --> T["body-policy fixtures"]
  subgraph Legend
    direction LR
    _evt(["Event"]) ~~~ _job["Workflow/Job"] ~~~ _file["Script/Test"]
  end

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Use GitHub Advanced Security secret scanning / push protection

• ➕ Native detection with fewer custom regexes to maintain
• ➕ Integrates well with GitHub UX (alerts, remediation, history)
• ➖ Requires GHAS licensing/enablement; not always available for public repos/org policy
• ➖ Doesn’t directly cover custom “private repo + ops detail” proximity rules

2. Single job with a matrix for tree vs body scans

• ➕ Less duplicated workflow boilerplate
• ➕ Easier to keep versions/pins aligned
• ➖ Harder to express different concurrency policies (cancel vs don’t-cancel) cleanly
• ➖ Higher risk of accidentally paying for full checkouts on comment events

3. Webhook-based scanner (external service)

• ➕ Can scan and alert immediately, independent of GitHub Actions runner availability
• ➕ Centralized rules management across many repos
• ➖ Adds operational burden (service hosting, auth, rate limits)
• ➖ More complex security surface than an in-repo workflow

Recommendation: Keep the PR’s approach: a dedicated in-workflow body scan job with event-shape validation, sparse checkout, and non-cancelling concurrency is a pragmatic, low-ops way to close a real visibility gap without granting elevated permissions. Native secret scanning is worth considering where GHAS is available, but it won’t fully replace the custom policy constraints and org-variable-driven private repo proximity logic implemented here.

Files changed (3) +342 / -5

Enhancement (1) +139 / -0

body-policy.shNew body policy scanner with redacted reporting and proximity-based private-repo rule +139/-0

New body policy scanner with redacted reporting and proximity-based private-repo rule

• Adds a fail-closed ripgrep-based scanner for PR/issue/comment text stored in a file, with line-level allowlisting and an allowlist for security/control discussions. Implements blocking rules for credential formats and infrastructure identifiers, plus a proximity rule that flags private repo names only when near operational detail (fed by GUARD_PRIVATE_REPOS). Outputs annotations that never echo matched secret text (line numbers only).

scripts/public-repo-guard/body-policy.sh

Tests (1) +108 / -0

body-policy.test.shAdd fixture-only tests to validate body-policy precision and fail-closed behavior +108/-0

Add fixture-only tests to validate body-policy precision and fail-closed behavior

• Introduces hermetic fixture tests that assert both blocking detections and critical non-blocking cases (to prevent the gate being disabled due to false positives). Verifies annotations do not reprint matched text and exercises fail-closed paths (missing/invalid input). Avoids embedding credential-shaped literals in source by assembling sensitive-looking fixtures at runtime.

scripts/public-repo-guard/tests/body-policy.test.sh

Other (1) +95 / -5

public-repo-guard.ymlAdd body-guard job and event coverage; split per-job concurrency +95/-5

Add body-guard job and event coverage; split per-job concurrency

• Extends triggers to include issues and issue comments (including edited events) and adds a new "Body content policy" job that scans materialized title/body text from the event payload. Introduces per-job concurrency policies so tree scans can cancel on updates while body scans keep all versions, avoiding lingering cancelled check-runs. Updates actions/checkout pin to v7.0.1 and adds a fixtures self-test step for the body policy.

.github/workflows/public-repo-guard.yml

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (1) 📘 Rule violations (0) 📜 Skill insights (0)

1. PR-controlled body scanner 🐞 Bug ⛨ Security

Description

The body-guard job runs on pull_request events but checks out repo code without pinning to a trusted
base revision, then executes scripts from that checkout; a malicious PR can modify body-policy.sh to
always pass (or change behavior) and defeat the new body leak gate.

Code

.github/workflows/public-repo-guard.yml[R128-131]

+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          # Only the gate's own scripts are needed — no reason to pay for the whole
+          # tree on every comment.

Evidence

The workflow explicitly runs body-guard on pull_request and then checks out the repo and runs
body-policy.sh from that checkout. Because the checkout step does not specify a trusted ref, the
script source can be influenced by the PR itself during pull_request runs, enabling bypass by
editing the scanner in the PR.

.github/workflows/public-repo-guard.yml[113-163]
scripts/public-repo-guard/body-policy.sh[12-28]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
`body-guard` runs on `pull_request` events but executes `scripts/public-repo-guard/body-policy.sh` from the checked-out repository contents. With `actions/checkout` not pinned to a trusted ref, a PR can change `body-policy.sh` in the same PR and make the body scan always pass, defeating the purpose of the new control.

### Issue Context
The workflow already has the untrusted body content in `$GITHUB_EVENT_PATH`; the only reason to checkout is to obtain the scanner scripts. For `pull_request` events, those scripts should come from a trusted source (base branch/commit), not from the PR.

### Fix Focus Areas
- .github/workflows/public-repo-guard.yml[113-163]

### Implementation notes
- In `body-guard`, set the checkout `ref` to a trusted base revision when `github.event_name == 'pull_request'` (e.g. `${{ github.event.pull_request.base.sha }}`), and otherwise to the default branch/`github.ref` for issue/comment events.
- Keep the sparse checkout, but ensure it pulls from the trusted ref.
- Optionally set `persist-credentials: false` since the job doesn’t need git auth after checkout.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

Context used

Review mode: ⚖️ Balanced: Downgraded extended -> standard: change is below the extended eligibility bar (hunks 5/18, lines 347/200; both must reach the floor). Router rationale: This adds security-sensitive CI behavior plus substantial shell policy logic, workflow event/concurrency paths, and fixture coverage across multiple independent edit sites where subtle failures are easy to miss.

_{To customize comments, go to the Qodo configuration screen, or learn more in the docs.}

[qodo-code-review]

Qodo Fixer

✅ Merged (0) · ☑ Fixed (0)

Process

• No fixes were applied (no_fixes_applied)

[devin-ai-integration]

Devin Review found 2 new potential issues.

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_86adf5e8-be25-4e09-b0ce-5d6efff24718)

[devin-ai-integration]

Devin Review found 1 new potential issue.

[codeant-ai]

🤖 CodeAnt AI — Review Status

Status	Commit	Started (UTC)	Finished (UTC)
✅ Incremental review completed	882e965	Sep 08, 2026 · 18:28	18:28
✅ Reviewed your PR	d16a745	Sep 06, 2026 · 22:45	22:47

[codeant-ai]

---

Thanks for using CodeAnt! 🎉

We're free for open-source projects. if you're enjoying it, help us grow by sharing.

Share on X ·
Reddit ·
LinkedIn

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_a225b54d-5325-4c8b-b2cc-cb30549210dd)

[qodo-code-review]

ⓘ Qodo reviews are paused because your workspace is out of credits. Ask your workspace admin to add credits to resume reviews. Manage billing

[codeant-ai]

Suggestion: The body job checks out the PR base, so the installation PR's base may lack body-policy.sh; the later command then fails before scanning the body. [state/lifecycle]

Assessment: 🟠 Major · 🔁 Occurrence: Often

Prompt for AI Agent 🤖

This is a comment left during a code review.

**Path:** .github/workflows/public-repo-guard.yml
**Line:** 203:203
**Comment:**
	*State Lifecycle: The body job checks out the PR base, so the installation PR's base may lack `body-policy.sh`; the later command then fails before scanning the body.

Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix

👍 | 👎

[codeant-ai]

Suggestion: The prose filter removes every heuristic match on a line mentioning body-policy or another control name, allowing leaked operational details to bypass detection by appending that phrase. [security]

Assessment: 🔴 Critical · 🔁 Occurrence: Sometimes

Prompt for AI Agent 🤖

This is a comment left during a code review.

**Path:** scripts/public-repo-guard/body-policy.sh
**Line:** 68:70
**Comment:**
	*Security: The prose filter removes every heuristic match on a line mentioning `body-policy` or another control name, allowing leaked operational details to bypass detection by appending that phrase.

Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix

👍 | 👎

[codeant-ai]

CodeAnt Nitpicks

1 code suggestion

1. The harness checks only the exit code and complete-body absence, so another rule can mask a broken rule or a partial secret can still leak in annotations.

Code quality · scripts/public-repo-guard/tests/body-policy.test.sh:29-37

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_7b84e0f1-ac5f-4c09-bf72-9d596529c4e0)

[sourcery-ai]

Sourcery assessment

Approved.

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_f204d436-c75b-40c2-82e4-6f3f80d24b7b)