fix(privacy): de-personalize installed skill payload + add PII gate #225
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Security Checks | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| schedule: | |
| - cron: '0 9 * * 1' # Weekly Monday 9am UTC | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| jobs: | |
| shellcheck-strict: | |
| name: ShellCheck (error severity) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| steps: | |
| - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 | |
| - name: Run ShellCheck at error severity | |
| uses: ludeeus/action-shellcheck@00cae500b08a931fb5698e11e79bfbd38e612a38 # v2.0.0 | |
| with: | |
| scandir: '.' | |
| severity: error | |
| ignore_paths: terminal-academy node_modules | |
| secret-scan: | |
| name: Secret scanning | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| steps: | |
| - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 | |
| with: | |
| fetch-depth: 0 | |
| - name: Scan for hardcoded secrets | |
| run: | | |
| # Fail if real-looking API keys are found in tracked files | |
| if git ls-files | xargs grep -lniE \ | |
| "(sk-ant-api|ghp_[0-9A-Za-z]{36}|xoxb-[0-9A-Za-z-]+|AKIA[0-9A-Z]{16})" \ | |
| 2>/dev/null | grep -v ".git"; then | |
| echo "::error::Potential hardcoded secrets detected — see matches above" | |
| exit 1 | |
| fi | |
| echo "No hardcoded secrets detected" | |
| pii-guard: | |
| name: Personal-context guard | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 | |
| - name: Block maintainer PII and client names in shippable files | |
| env: | |
| # Private marker list (client/project roster, vault name). Kept in a | |
| # secret so the roster never appears in this public repo — a hardcoded | |
| # list would publish the exact thing the guard protects. Generic checks | |
| # (real home paths, bare emails) run even when the secret is unset. | |
| PII_EXTRA_PATTERNS: ${{ secrets.PII_EXTRA_PATTERNS }} | |
| run: | | |
| # Every skill file here installs into somebody else's ~/.claude/skills/. | |
| # Personal names, client rosters, and private vault paths must not ship. | |
| # Regression on 2026-08-17: an update overwrote a downstream scrub and | |
| # redistributed the client roster to 5 external installers. | |
| if [ -z "${PII_EXTRA_PATTERNS:-}" ]; then | |
| echo "::warning::PII_EXTRA_PATTERNS secret is unset — only generic checks ran. Set it in repo settings for full roster coverage." | |
| fi | |
| if ! ./scripts/check-pii.sh; then | |
| echo "::error::Personal operating context detected in shippable files — see matches above" | |
| exit 1 | |
| fi | |
| download-url-check: | |
| name: Verify pinned download URLs are reachable | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| steps: | |
| - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 | |
| - name: Check SKILL_URL in step-8 | |
| run: | | |
| COMMIT=$(grep 'SKILL_COMMIT=' step-8/step-8-install.sh | head -1 | cut -d'"' -f2) | |
| URL="https://raw.githubusercontent.com/fidgetcoding/cli-maxxing/${COMMIT}/step-8/safetycheck-skill/SKILL.md" | |
| HTTP_STATUS=$(curl -o /dev/null -s -w "%{http_code}" "$URL") | |
| if [ "$HTTP_STATUS" != "200" ]; then | |
| echo "::error::Pinned SKILL_URL returned HTTP $HTTP_STATUS — commit SHA may be invalid" | |
| exit 1 | |
| fi | |
| echo "SKILL_URL OK (HTTP 200) for commit $COMMIT" |