ci: scan issue and comment bodies — this repo has never scanned one

[yakimoto]

User description

This repo's public-repo-guard has never scanned a single issue or comment body.

Measured across all 28 public wave-av repos (wave-av/claude-workstation#1747, #1794): two coverage shapes satisfy the one required check name Secrets + content policy.

repos	triggers	jobs
27	pull_request, push, workflow_dispatch	guard
1	+ issues, issue_comment	+ body-guard

This repo is in the 27. All 28 report the same green check — because a required check asserts that something named X passed, never what X examined.

The outlier is wave-moq-edge, and its own comment says why it matters:

edited matters as much as opened: a body can be made to leak long after the PR is first raised, and until this workflow covered it, nothing ever re-scanned.

That gap was not theoretical there: a PR was blocked for naming a private repo in wrangler.toml while the very same name, with more operational detail attached, sat unchallenged in its body.

What lands

Three files — the bundle the workflow's own header names, minus what this repo already has (.gitleaks.toml and content-policy.sh are already vendored, and are checked as prerequisites; a repo missing either is refused rather than half-installed):

.github/workflows/public-repo-guard.yml               replaced (72 -> 163 lines)
scripts/public-repo-guard/body-policy.sh              new, mode 100755
scripts/public-repo-guard/tests/body-policy.test.sh   new, mode 100755

The workflow's header names four files as the install unit but executes a fifth — tests/body-policy.test.sh, in its own self-test step. Omitting it installs a workflow that fails on a step nobody read, so the manifest ships it. Modes are preserved via the git trees API; the contents API creates 100644 regardless, which would silently break running these scripts as executables.

Planned by governance/lib/vendor-bundle.mjs (claude-workstation#1850) against a checked-in manifest, not by ad-hoc shell.

One deliberate divergence from the reference, stated rather than silent

The shipped workflow is wave-moq-edge's with actions/checkout bumped from v5.0.1 to v7.0.1 (3d3c42e5aac5ba805825da76410c181273ba90b1), the pin already used by claude-workstation's own gate.

Copying verbatim was checked first and rejected on evidence: of the 18 target repos, 17 carry a byte-identical guard, and wave-realtime-edge already runs v7.0.0 — so a verbatim copy would have downgraded it, and shipped a stale pin to the other 17. A separate PR brings the reference itself up to the same pin.

Honest about what this can and cannot do

On a PR this PREVENTS the merge. On an issue or comment the text is already public the moment it posts, so this is DETECTION: it says go redact, fast. Only a client-side pre-write hook stops that class before publication.

Also inherited from the reference: concurrency moves from workflow-level to per job, because the two jobs want opposite behaviour. A workflow-level group forced one policy on both, and rapid body edits cancelled the tree job repeatedly — every cancelled check-run stays attached to the commit, so the PR reported UNSTABLE while the live runs were green.

The body gate ships with its own fixtures and runs them in CI. Its negative cases are the load-bearing half: a leak gate that blocks legitimate cross-repo references gets switched off, and then it protects nothing.

Refs wave-av/claude-workstation#1747.

---

---

Note

Medium Risk
Expands required CI checks and merge-blocking heuristics on PR text; misconfiguration (e.g. empty GUARD_PRIVATE_REPOS) or rule regressions can fail checks or block legitimate bodies.

Overview
Closes a real coverage gap: tree scans never looked at PR/issue/comment/review text, so sensitive detail could sit in a body while the same content in files was blocked.

New body-guard job runs on pull_request (including edited), issues, issue_comment, pull_request_review, and pull_request_review_comment. It materializes title/body from the event payload via jq to a file (no shell interpolation), checks out a trusted ref (PR base SHA or default branch) with sparse checkout of scripts/public-repo-guard, and runs new body-policy.sh.

body-policy.sh mirrors many tree rules (credential formats, CF account_id, Tailscale IPs, operator paths) but uses a body-specific private-repo rule: bare cross-repo mentions are allowed; blocking requires a configured private repo name within ~140 chars of operational detail (credential names, secret bindings, secret counts). Annotations redact matches; GUARD_PRIVATE_REPOS missing in CI fails closed.

Existing guard job gains review-event handling (with careful if/skipped logic so review traffic cannot green-stamp a failing tree scan), per-job concurrency (tree cancels in-flight; body does not), pinned PCRE2-capable ripgrep, actions/checkout v7.0.1, and a CI step running body-policy.test.sh fixtures.

^{Reviewed by Cursor Bugbot for commit 326844a. Bugbot is set up for automated code reviews on this repo. Configure here.}

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is enabled.}

Note

Scan PR/issue/comment/review bodies for credential and infrastructure leaks in CI

• Adds body-policy.sh, a new Bash scanner that checks materialized PR/issue/comment/review text for credential formats (Stripe, Anthropic, GitHub PATs, AWS keys, PEM headers) and private repo name proximity to operational keywords.
• Adds a new body-guard CI job in public-repo-guard.yml triggered by issues, issue_comment, pull_request_review, and pull_request_review_comment events, with per-event concurrency keyed to the most specific object ID.
• Expands the existing guard job triggers to include review events and body-policy fixture tests; adds PCRE2-capable ripgrep installation to prevent false scanner failures.
• Adds body-policy.test.sh covering must-block, must-pass, and fail-closed fixture cases.
• Risk: the scanner fails closed (exit 2) when GUARD_PRIVATE_REPOS is unset in CI or when a non-PCRE2 rg is detected, blocking the check run.

^{Macroscope summarized c284c89.}

Summary by Sourcery

Extend the public repository guard to scan all publicly visible conversation text and fail safely when its policy checks cannot be performed.

New Features:

• Add CI scanning for pull request, issue, comment, review, and review-thread text on creation and edits.
• Add a body content policy scanner that detects credentials, sensitive infrastructure details, and private repository names paired with operational information while allowing ordinary cross-references.

Bug Fixes:

• Close the gap where publicly visible conversation text was not scanned by the repository guard.
• Ensure scanner failures, missing required configuration, unsupported ripgrep capabilities, and unrecognized event payloads fail closed rather than report success.

Enhancements:

• Separate tree and body guard concurrency to preserve reliable verdicts during frequent body updates and comments.
• Use trusted policy scripts and safely materialize event text without shell interpolation.
• Pin and verify a PCRE2-capable ripgrep release and update the checkout action.

CI:

• Expand public-repo-guard triggers and add a dedicated body-guard job for conversation content.
• Run body-policy fixture tests in CI.

Tests:

• Add fixture coverage for blocked leaks, allowed cross-repository references, false-positive protections, redacted findings, and fail-closed behavior.

---

CodeAnt-AI Description

Scan all public conversation text for secrets and internal information

What Changed

• Pull request, issue, top-level comment, review, and review-thread text is now scanned when created or edited
• New checks block exposed credentials, private keys, internal addresses and paths, not-for-public language, and private repository names paired with operational details
• Bare private-repository references and quoted policy examples remain allowed to avoid blocking normal documentation and cross-repository discussion
• Findings show only line numbers and never repeat the detected sensitive text
• Missing inputs, scanner failures, required configuration, and unsupported scanner capabilities now fail closed instead of reporting a pass
• Added fixture tests covering blocked leaks, allowed references, false-positive protections, redacted output, and failure handling

Impact

✅ Fewer unscanned PR and issue leaks
✅ Faster detection of exposed credentials and internal details
✅ Fewer false blocks for ordinary cross-repository references

💡 Usage Guide

Checking Your Pull Request

Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.

Talking to CodeAnt AI

Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:

@codeant-ai ask: Your question here

This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.

Example

@codeant-ai ask: Can you suggest a safer alternative to storing this secret?

Preserve Org Learnings with CodeAnt

You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:

@codeant-ai: Your feedback here

This helps CodeAnt AI learn and adapt to your team's coding style and standards.

Example

@codeant-ai: Do not flag unused imports.

Retrigger review

Ask CodeAnt AI to review the PR again, by typing:

@codeant-ai: review

Check Your Repository Health

To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.

[coderabbitai]

Important

Review skipped

Auto reviews are limited based on label configuration.

🚫 Excluded labels (none allowed) (1)

• rr:skip-coderabbit

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Team

Run ID: f7a81a22-1a3b-44f1-ba22-b9febc45e3d3

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_31b04dac-ddcf-4755-b62e-bd5e19d92c8d)

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This PR introduces a new merge-blocking body scanner and expands a security-sensitive workflow across issue, comment, and review events. An unresolved review comment identifies a concrete allowlist bypass in heuristic filtering, so the policy and workflow behavior warrant human validation.

Not approved because:

• Credit balance exhausted. Approvability relies on correctness review in order to determine eligibility

^{Review your spending limits in Billing settings. You can add or adjust custom eligibility rules. Learn more.}

[qodo-code-review]

PR Summary by Qodo

CI: scan issue/PR/comment bodies in public-repo-guard (with fixtures + safe concurrency)

✨ Enhancement ⚙️ Configuration changes 🧪 Tests 🕐 40+ Minutes

AI Description

• Add a dedicated body-scanning job for PR/issue/comment text, including edited events.
• Introduce a fail-closed body policy script with allowlists and redacted reporting.
• Add fixture-only self-tests and per-job concurrency to prevent unstable/cancelled checks.

Diagram

graph TD
  E(["GitHub events\nPR / issues / comments"]) --> W["public-repo-guard workflow"] --> J1["Job: guard (tree)"] --> S1["content-policy.sh"]
  W --> J2["Job: body-guard"] --> M["Materialize body.txt"] --> S2["body-policy.sh"]
  J1 --> T["body-policy fixtures"]
  subgraph Legend
    direction LR
    _evt(["Event"]) ~~~ _job["Workflow/Job"] ~~~ _file["Script/Test"]
  end

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Use GitHub Advanced Security secret scanning / push protection

• ➕ Native detection with fewer custom regexes to maintain
• ➕ Integrates well with GitHub UX (alerts, remediation, history)
• ➖ Requires GHAS licensing/enablement; not always available for public repos/org policy
• ➖ Doesn’t directly cover custom “private repo + ops detail” proximity rules

2. Single job with a matrix for tree vs body scans

• ➕ Less duplicated workflow boilerplate
• ➕ Easier to keep versions/pins aligned
• ➖ Harder to express different concurrency policies (cancel vs don’t-cancel) cleanly
• ➖ Higher risk of accidentally paying for full checkouts on comment events

3. Webhook-based scanner (external service)

• ➕ Can scan and alert immediately, independent of GitHub Actions runner availability
• ➕ Centralized rules management across many repos
• ➖ Adds operational burden (service hosting, auth, rate limits)
• ➖ More complex security surface than an in-repo workflow

Recommendation: Keep the PR’s approach: a dedicated in-workflow body scan job with event-shape validation, sparse checkout, and non-cancelling concurrency is a pragmatic, low-ops way to close a real visibility gap without granting elevated permissions. Native secret scanning is worth considering where GHAS is available, but it won’t fully replace the custom policy constraints and org-variable-driven private repo proximity logic implemented here.

Files changed (3) +342 / -5

Enhancement (1) +139 / -0

body-policy.shNew body policy scanner with redacted reporting and proximity-based private-repo rule +139/-0

New body policy scanner with redacted reporting and proximity-based private-repo rule

• Adds a fail-closed ripgrep-based scanner for PR/issue/comment text stored in a file, with line-level allowlisting and an allowlist for security/control discussions. Implements blocking rules for credential formats and infrastructure identifiers, plus a proximity rule that flags private repo names only when near operational detail (fed by GUARD_PRIVATE_REPOS). Outputs annotations that never echo matched secret text (line numbers only).

scripts/public-repo-guard/body-policy.sh

Tests (1) +108 / -0

body-policy.test.shAdd fixture-only tests to validate body-policy precision and fail-closed behavior +108/-0

Add fixture-only tests to validate body-policy precision and fail-closed behavior

• Introduces hermetic fixture tests that assert both blocking detections and critical non-blocking cases (to prevent the gate being disabled due to false positives). Verifies annotations do not reprint matched text and exercises fail-closed paths (missing/invalid input). Avoids embedding credential-shaped literals in source by assembling sensitive-looking fixtures at runtime.

scripts/public-repo-guard/tests/body-policy.test.sh

Other (1) +95 / -5

public-repo-guard.ymlAdd body-guard job and event coverage; split per-job concurrency +95/-5

Add body-guard job and event coverage; split per-job concurrency

• Extends triggers to include issues and issue comments (including edited events) and adds a new "Body content policy" job that scans materialized title/body text from the event payload. Introduces per-job concurrency policies so tree scans can cancel on updates while body scans keep all versions, avoiding lingering cancelled check-runs. Updates actions/checkout pin to v7.0.1 and adds a fixtures self-test step for the body policy.

.github/workflows/public-repo-guard.yml

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (1) 📘 Rule violations (0) 📜 Skill insights (0)

1. PR-controlled body scanner 🐞 Bug ⛨ Security

Description

The body-guard job runs on pull_request events but checks out repo code without pinning to a trusted
base revision, then executes scripts from that checkout; a malicious PR can modify body-policy.sh to
always pass (or change behavior) and defeat the new body leak gate.

Code

.github/workflows/public-repo-guard.yml[R128-131]

+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          # Only the gate's own scripts are needed — no reason to pay for the whole
+          # tree on every comment.

Evidence

The workflow explicitly runs body-guard on pull_request and then checks out the repo and runs
body-policy.sh from that checkout. Because the checkout step does not specify a trusted ref, the
script source can be influenced by the PR itself during pull_request runs, enabling bypass by
editing the scanner in the PR.

.github/workflows/public-repo-guard.yml[113-163]
scripts/public-repo-guard/body-policy.sh[12-28]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
`body-guard` runs on `pull_request` events but executes `scripts/public-repo-guard/body-policy.sh` from the checked-out repository contents. With `actions/checkout` not pinned to a trusted ref, a PR can change `body-policy.sh` in the same PR and make the body scan always pass, defeating the purpose of the new control.

### Issue Context
The workflow already has the untrusted body content in `$GITHUB_EVENT_PATH`; the only reason to checkout is to obtain the scanner scripts. For `pull_request` events, those scripts should come from a trusted source (base branch/commit), not from the PR.

### Fix Focus Areas
- .github/workflows/public-repo-guard.yml[113-163]

### Implementation notes
- In `body-guard`, set the checkout `ref` to a trusted base revision when `github.event_name == 'pull_request'` (e.g. `${{ github.event.pull_request.base.sha }}`), and otherwise to the default branch/`github.ref` for issue/comment events.
- Keep the sparse checkout, but ensure it pulls from the trusted ref.
- Optionally set `persist-credentials: false` since the job doesn’t need git auth after checkout.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

Context used

Review mode: ⚖️ Balanced: Downgraded extended -> standard: change is below the extended eligibility bar (hunks 5/18, lines 347/200; both must reach the floor). Router rationale: This adds security-sensitive CI behavior plus substantial shell policy logic, workflow event/concurrency paths, and fixture coverage across multiple independent edit sites where subtle failures are easy to miss.

_{To customize comments, go to the Qodo configuration screen, or learn more in the docs.}

[qodo-code-review]

Qodo Fixer

✅ Merged (0) · ☑ Fixed (0)

Process

• No fixes were applied (no_fixes_applied)

[devin-ai-integration]

Devin Review found 2 new potential issues.

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_86adf5e8-be25-4e09-b0ce-5d6efff24718)

[devin-ai-integration]

Devin Review found 1 new potential issue.

[codeant-ai]

🤖 CodeAnt AI — Review Status

Status	Commit	Started (UTC)	Finished (UTC)
✅ Reviewed your PR	d16a745	Sep 06, 2026 · 22:45	22:47

[codeant-ai]

---

Thanks for using CodeAnt! 🎉

We're free for open-source projects. if you're enjoying it, help us grow by sharing.

Share on X ·
Reddit ·
LinkedIn

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_a225b54d-5325-4c8b-b2cc-cb30549210dd)

[qodo-code-review]

ⓘ Qodo reviews are paused because your workspace is out of credits. Ask your workspace admin to add credits to resume reviews. Manage billing

[codeant-ai]

Suggestion: The body job checks out the PR base, so the installation PR's base may lack body-policy.sh; the later command then fails before scanning the body. [state/lifecycle]

Assessment: 🟠 Major · 🔁 Occurrence: Often

Prompt for AI Agent 🤖

This is a comment left during a code review.

**Path:** .github/workflows/public-repo-guard.yml
**Line:** 203:203
**Comment:**
	*State Lifecycle: The body job checks out the PR base, so the installation PR's base may lack `body-policy.sh`; the later command then fails before scanning the body.

Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix

👍 | 👎

[codeant-ai]

Suggestion: The prose filter removes every heuristic match on a line mentioning body-policy or another control name, allowing leaked operational details to bypass detection by appending that phrase. [security]

Assessment: 🔴 Critical · 🔁 Occurrence: Sometimes

Prompt for AI Agent 🤖

This is a comment left during a code review.

**Path:** scripts/public-repo-guard/body-policy.sh
**Line:** 68:70
**Comment:**
	*Security: The prose filter removes every heuristic match on a line mentioning `body-policy` or another control name, allowing leaked operational details to bypass detection by appending that phrase.

Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix

👍 | 👎

[codeant-ai]

CodeAnt Nitpicks

1 code suggestion

1. The harness checks only the exit code and complete-body absence, so another rule can mask a broken rule or a partial secret can still leak in annotations.

Code quality · scripts/public-repo-guard/tests/body-policy.test.sh:29-37

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_7b84e0f1-ac5f-4c09-bf72-9d596529c4e0)

[sourcery-ai]

Sourcery assessment

Approved.