Repository navigation
Add a pull request privacy scan - #8
Merged
Merged
Conversation
Check added lines, the pull request title and body, and commit messages on every branch. This repository has no project test runner, so the workflow also runs the privacy scan tests. Co-authored-by: Mike Haldas <mikehaldas@users.noreply.github.com>
mikehaldas
marked this pull request as ready for review
October 14, 2026 19:36
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This adds a privacy check that runs on pull requests for every branch. The workflow calls
.github/scripts/privacy_scan.pywith the Python 3 standard library. No bot or model is involved.The script checks added lines from the three-dot diff, the pull request title and body from the event payload, and commit messages from git log. A failure prints
file:lineand the rule name. Confidential-term matches are printed as[confidential term]and the matched text is not logged.Copied from the privacy scan on
viewtron-python-sdk(cursor/privacy-scan-cd16) without changing these files:.github/scripts/privacy_scan.pyscripts/hash_terms.py.github/privacy-scan-allow.txt.github/privacy-scan-plates-approved.txt(the only approved plate is the fake test plate IB36NL)tests/test_privacy_scan.pyThis repository has no project test runner, so
.github/workflows/privacy-scan.ymlalso installs pytest in a temporary virtualenv and runstests/test_privacy_scan.py. That is the only change to the workflow. The README has a short Privacy scan section.PRIVACY_SCAN_TERMSsecret: one SHA-256 hex line per lowercase term. The scanner hashes word n-grams of one to three words, and the same n-grams with spaces, hyphens, and underscores removed. If that secret is unset, the job warns and skips only that rule. Usescripts/hash_terms.pylocally to build the digests..github/privacy-scan-allow.txtstill has no entries.PRIVACY_SCAN_PLATES, a value in a plate field, or a quoted token of 4 to 8 uppercase letters and digits that contains a letter and a digit on a line that mentions plate, lpr, anpr, or the phrase license plate. Common tech tokens, model names with an ip-, lpr-, or nvr- prefix, and hex or uuid-like strings are ignored..github/privacy-scan-plates-approved.txtcontains one fake test plate, IB36NL, approved by Mike on 2026-10-14.Scan of the repository tip
Tracked files at HEAD were scanned, along with the tip commit message. Term digests and plate digests were not configured in this environment, so those two digest checks were skipped with a warning. Counts are by rule and file. Matched text is omitted.
private-ip: 103
license-plate: 30
The diff for this pull request has no findings. Local pytest: 35 passed. This pull request is a draft and is not merged.