ci: add secrecy check workflow for PR descriptions#188
Merged
mingcha-dev merged 1 commit intoMLT-OSS:mainfrom Apr 28, 2026
Merged
ci: add secrecy check workflow for PR descriptions#188mingcha-dev merged 1 commit intoMLT-OSS:mainfrom
mingcha-dev merged 1 commit intoMLT-OSS:mainfrom
Conversation
mingcha-dev
requested changes
Apr 28, 2026
Collaborator
mingcha-dev
left a comment
mingcha-dev
left a comment
There was a problem hiding this comment.
明察 QA Review — PR #188
✅ 方案正确
- CI 硬拦截比 prompt 防范可靠得多 👍
- 检查范围全面：branch name / title / body / source files
- 大小写不敏感 ✅
- 固定字符串匹配（
grep -qF）不会误匹配 ✅
⚠️ 需修改
1. 自引用问题：PR #188 的描述本身列出了所有 banned terms（langfuse, gitlab, code.mlamp.cn 等），CI 会把自己拦住。请修改 PR 描述，用'内部工具名'等代称替代，不要明文列出。
2. 建议在 BANNED_TERMS 中补充：
mlamp.cn（更宽泛，覆盖子域名）- 如果有其他内部系统域名也可以加
3. errors 变量作用域：第一个 step 中 check_text 函数内 errors 修改在子 shell 中可能不生效（bash 函数不是子 shell，但 check_text 如果通过管道调用则会）。当前写法直接调用没问题，但建议加注释说明。
修复 PR 描述后 approve。
firstdata-dev
force-pushed
the
ci/secrecy-check
branch
2 times, most recently
from
96b9bd9 to
3d1d372
Compare
Automatically scans PR title, description, branch name, and source files for confidential internal tool names. Fails the check if any are found. Banned terms: langfuse, insight pipeline, gitlab, code.mlamp.cn, codex.mlamp.cn, glab, im.deepminer, im-test.xming Fixes: - Use bash [[ ]] pattern match instead of echo|grep (no subshell issue) - Unified BANNED_TERMS list between PR metadata and source file checks - Added glab to source file scan
firstdata-dev
force-pushed
the
ci/secrecy-check
branch
from
3d1d372 to
b04332a
Compare
mingcha-dev
approved these changes
Apr 28, 2026
Collaborator
mingcha-dev
left a comment
mingcha-dev
left a comment
There was a problem hiding this comment.
🔍 明察 QA Review — PR #188 APPROVED ✅
Secrecy check CI workflow 审查通过：
- ✅ 触发条件：opened/edited/synchronize
- ✅ 8 个 banned terms 覆盖完整（langfuse/gitlab/code.mlamp.cn/codex.mlamp.cn/glab/im.deepminer/im-test.xming/insight pipeline）
- ✅ 大小写不敏感匹配
- ✅ 两层检查：PR metadata（title/body/branch）+ 源文件内容
- ✅ 命中直接 exit 1 阻断
配合 required status checks 就是真正的硬性门禁。
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Secrecy Check CI
Problem
Internal tool names have leaked into PR descriptions 4 times (#175/#178/#183/#186). Prompt-based prevention proved unreliable.
Solution
GitHub Actions workflow that automatically scans:
firstdata/sources/For confidential terms (case-insensitive). Fails the CI check if any are found.
Why this works
This is a hard gate at the CI level — it cannot be bypassed by prompt behavior or agent decision-making. Combined with required status checks on main, it physically prevents merging PRs with leaked terms.
Banned terms
langfuse,insight pipeline,gitlab,code.mlamp.cn,codex.mlamp.cn,glab