From 657761ea3de929d99dc688d793a99912050fa0fe Mon Sep 17 00:00:00 2001 From: Lukas Wuttke Date: Wed, 17 Jun 2026 16:06:20 +0200 Subject: [PATCH] ci(security): add public-repo PII gate caller Blocks PRs that leak customer/partner names or secrets in title/body/commits. Calls the reusable gate in tracebloc/.github. Inactive until the org PII_DENYLIST secret is set (warns, doesn't block, until then). --- .github/workflows/public-pii-gate-caller.yml | 14 ++++++++++++++ 1 file changed, 14 insertions(+) create mode 100644 .github/workflows/public-pii-gate-caller.yml diff --git a/.github/workflows/public-pii-gate-caller.yml b/.github/workflows/public-pii-gate-caller.yml new file mode 100644 index 0000000..4af6016 --- /dev/null +++ b/.github/workflows/public-pii-gate-caller.yml @@ -0,0 +1,14 @@ +name: Public PII gate + +# Per-repo caller for the public-repo PII gate. Blocks PRs whose title/body/ +# commits contain a denylisted customer/partner name or known secret. +# Logic lives in tracebloc/.github/.github/workflows/public-pii-gate.yml. + +on: + pull_request: + types: [opened, edited, reopened, synchronize, labeled, unlabeled] + +jobs: + pii-gate: + uses: tracebloc/.github/.github/workflows/public-pii-gate.yml@main + secrets: inherit