54 lines
2.5 KiB
YAML
54 lines
2.5 KiB
YAML
name: sanitize
|
|
# PR gate: block personal data, secrets and tenant-internal references from
|
|
# entering the shared skill library. Every layer boundary is a gate.
|
|
# Deliberately PR-only: INSIDE a private tenant repo internal details are
|
|
# legitimate; the gate guards the boundary to the shared layers.
|
|
on:
|
|
pull_request:
|
|
|
|
jobs:
|
|
pii-scan:
|
|
runs-on: windows
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- name: Scan for PII / secrets / internal URLs
|
|
shell: python
|
|
run: |
|
|
import os, re, sys
|
|
|
|
RULES = [
|
|
("e-mail address", re.compile(r"[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}")),
|
|
("phone number", re.compile(r"(?<![\w/.-])\+?\d[\d ()\-]{8,}\d(?![\w/])")),
|
|
("secret assignment", re.compile(r"(?i)(password|passwd|secret|api[_-]?key|token)\s*[:=]\s*['\"]?[A-Za-z0-9_\-]{6,}")),
|
|
("internal URL/host", re.compile(r"(?i)(\bintranet\b|\.internal\b|\.local\b|\.corp\b|\b10\.\d{1,3}\.\d{1,3}\.\d{1,3}\b|\b192\.168\.\d{1,3}\.\d{1,3}\b)")),
|
|
("person name marker", re.compile(r"(?i)\b(hiring manager|contact):\s*[A-Z][a-z]+ [A-Z][a-z]+")),
|
|
]
|
|
ALLOW = re.compile(r"(?i)(esco\.ec\.europa\.eu|onetcenter\.org|data\.europa\.eu|creativecommons\.org)")
|
|
|
|
findings = []
|
|
for root, dirs, files in os.walk("."):
|
|
dirs[:] = [d for d in dirs if d not in (".git", ".gitea")]
|
|
for name in files:
|
|
path = os.path.join(root, name)
|
|
try:
|
|
text = open(path, encoding="utf-8", errors="ignore").read()
|
|
except OSError:
|
|
continue
|
|
for lineno, line in enumerate(text.splitlines(), 1):
|
|
if ALLOW.search(line):
|
|
continue
|
|
for label, rx in RULES:
|
|
m = rx.search(line)
|
|
if not m:
|
|
continue
|
|
# ISO-Datumsangaben (2026-07-06) sind keine Telefonnummern
|
|
if label == "phone number" and re.fullmatch(r"\d{4}-\d{2}-\d{2}", m.group(0)):
|
|
continue
|
|
findings.append(f"{path}:{lineno}: {label}: {line.strip()[:120]}")
|
|
|
|
if findings:
|
|
print("SANITIZE GATE FAILED โ remove/anonymize before publishing:")
|
|
print("\n".join(findings))
|
|
sys.exit(1)
|
|
print("sanitize: clean โ no PII, secrets or internal references found.")
|