Repository navigation
refactor(sanitization): call the canonical gate - #3
Merged
Merged
Conversation
The vendored check_sanitization.py had drifted from the other repos' copies. CI now calls the canonical reusable workflow in cyborg-garden/swarm-map, pinned to sanitization-gate-v1.0.0, and this repo keeps only its sanitize.config.json. scripts/check_sanitization.py becomes a launcher that fetches the canonical script at the same tag, so local runs and docs keep working. The gate's self-tests move to swarm-map; a thin test here keeps the two pins in step. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
A pin to a missing sanitization-gate tag makes the caller job fail before it starts, with no check on the PR, so the PR can look green. Say so beside the pin and ask for the check to be required. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The canonical gate now matches allow entries exactly, refuses config that disables or narrows layer 1, and scans every PR with the base branch's config. Update the config comments and docs to match; in osint-engine, replace the '+1555' prefix entry with allow_fiction_phones, since prefixes no longer excuse anything. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Route changes to .github/, sanitize.config.json and the gate launcher to the owner for review. Advisory only: no branch protection requires code-owner review today, so this blocks nothing. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
uses: cyborg-garden/swarm-map/.github/workflows/sanitization-gate.yml@sanitization-gate-v1.0.0instead of a vendored script.scripts/check_sanitization.pybecomes a ~50-line launcher that fetches the canonical script at the same tag (local runs and docs keep working); the gate's self-tests move to swarm-map andtests/test_sanitization_pin.pykeeps the workflow pin and launcher tag in step.Why
Every agent repo carried its own copy of the gate and the copies had drifted, each missing a protection another had. One canonical gate (cyborg-garden/swarm-map#265), per-repo
sanitize.config.jsononly.Verification
tests/test_sanitization_pin.py: 4 passed. Launcher withSANITIZE_GATE_PATHpointed at the canonical branch:--check-configvalid;--all --deterministic-onlyclean.actionlintclean.Risk
sanitization-gate-v1.0.0. Until that tag exists this PR'ssanitizationcheck fails (it cannot resolve the pinned workflow) — re-run it after tagging.ANTHROPIC_API_KEYbut noOPENROUTER_API_KEY; its own same-repo PRs fail closed at the semantic step until one is set.🤖 Generated with Claude Code