Merge pull request #2911 from jaylfc/merge-back/beta.52 #1193
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Secret-ignores gate | |
| # Verifies that the committed .gitignore still protects known secret-shaped | |
| # paths (data/hub/identity.json, foo.key, creds.json, x.p8, ...) on every | |
| # promotion target. A .gitignore is the kind of file a rebase conflict can | |
| # quietly drop during a dev->master promotion while every test still passes and | |
| # nothing builds red, so promotion is verified here, not assumed. | |
| # | |
| # Trigger scope is deliberate: | |
| # - push to master/dev/release/* : a dropped pattern fails the branch it | |
| # lands on (this is the post-promotion check from tsk-laezfg step 1). | |
| # - pull_request to master/dev/release/* : a conflict-resolution loss fails | |
| # BEFORE the merge, since the merge commit's .gitignore is what is checked. | |
| # The run is pure stdlib (~1s), so it carries no shard-timeout risk. | |
| # | |
| # See scripts/check_secret_ignores.py for REQUIRED_PATTERNS and SECRET_PATHS. | |
| on: | |
| push: | |
| branches: [master, dev, release/*] | |
| pull_request: | |
| branches: [master, dev, release/*] | |
| jobs: | |
| secret-ignores-gate: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: actions/setup-python@v7 | |
| with: | |
| python-version: "3.12" | |
| - name: Assert secret-shaped paths are ignored | |
| run: python scripts/check_secret_ignores.py |