ci: run the shared leak scan on every PR

[quadseven]

Why

This repo is public, and nothing checks a PR for private infrastructure identifiers before it merges. What leaks here is not secret-shaped (hostnames, private-range IPs, local user paths, refs to private repos), so secret scanning never sees it. A shared, fail-closed leak scan already exists in quadseven/infra-public; this adds the thin caller. Upstream tracking: infra#2997.

Summary

• New .github/workflows/check.leak-scan.yml: calls _reusable.leak-scan.yml pinned to a full commit SHA, on pull_request (opened, synchronize, reopened, edited)
• Scans the PR diff and the PR title/body; enforcing, so a finding fails the check
• A scan that cannot run (missing scanner, unresolvable diff, empty diff on a PR with changes) fails the check rather than passing
• allowed-repo-refs lists only public repos this one cites routinely, plus the upstream tracker convention

Acceptance criteria

• The leak-scan check runs and passes on this PR
• A seeded throwaway PR carrying a planted private identifier turns the check red, and is closed unmerged
• No private hostname, IP, path or repo name appears in the caller or in this PR's text

Out of scope

• Retro-scrubbing existing history
• The runtime deny-list layer (terms with no generic shape); it needs per-repo credentials and is a separate follow-up

Size: S

Codex adversarial review: one finding (pull-requests permission), declined with evidence in a PR comment.

Part of #83

https://claude.ai/code/session_01Ht7JaVzv2aacJ9r6Srso9r

[grug-tribe]

Walkthrough

Adds a new GitHub Actions workflow that invokes a shared, reusable leak-scan from the quadseven/infra-public repository to scan every pull request's diff, title, and body for accidental private infrastructure identifiers (hostnames, private IPs, device IDs, local paths, private repo refs). The scan runs on opened/synchronize/reopened/edited PR events, fails closed (a non-runnable scan is a failed check), and supports reviewed exceptions via a leak-guard-allow marker, with infra and infra-public listed as allowed repo references.

Review effort: quick (~5 min)

Changed files (1)

File	Summary	Changes
.github/workflows/check.leak-scan.yml	New workflow file wiring up the shared reusable leak-scan for PR diff/title/body scanning with fail-closed behavior and allowed-repo-refs for infra and infra-pu	+30/-0

Shape of the change

graph TD
  subgraph ".github"
    N0["check.leak-scan.yml"]
  end

Loading

Last walked at 04cd6b35a056.

[quadseven]

Codex adversarial review (pre-open), one finding, declined with evidence:

• [high] "caller grants only contents: read; add pull-requests: read in case the reusable reads PR metadata via the API." Declined. The pinned reusable reads the title and body from the event payload (github.event.pull_request.title/body, passed through env into a file) and the diff from a local git diff over a full-history checkout. It makes no pull-request API call, so pull-requests: read would be an unused grant. Proof: on the seeded throwaway wow-overseer#254 this exact caller, with contents: read only, printed the PR title in the scan step and failed on both planted identifiers in the diff. The edited path is exercised by the body edit that added this note.