feat: fail-closed guard against proprietary source in this public repo - #160
Open
marc-n-dream wants to merge 3 commits into
Open
feat: fail-closed guard against proprietary source in this public repo#160marc-n-dream wants to merge 3 commits into
marc-n-dream wants to merge 3 commits into
Conversation
Block native (Java/Kotlin) source, the private Gradle build system, and the private build pipeline from this public repo. Native code ships only as compiled .aar/.unitypackage/.bundle artifacts; the source lives in the private airconsole-unity-android-plugin and airconsole-unity-webview repos. Denylist (scripts/check-proprietary-source.sh, bash 3.2 safe): - *.java/*.kt/*.kts, *.gradle, *.pro, gradle wrapper/properties - *.sh/Rakefile/*.rake build scripts, *.toml version catalogs - AndroidManifest.xml, src/main/res/, .gitmodules - source patterns also match backup/merge suffixes (.orig/.bak/~/.txt) Allowlist: Unity gradle templates, this script, content-free *.meta. Layers: - .githooks/pre-commit: fast local gate (git config core.hooksPath .githooks) - .github/workflows/no-proprietary-source.yml: authoritative CI gate on every push (any branch) and PR, plus a submodule-gitlink rejection - .gitignore: ignore *.orig/*.bak/*~ so leaked source is not staged at all - AGENTS.md: contributor rules + hook install Denylist and layering verified against an adversarial red-team of the two private repos' full file inventory (10 confirmed gaps closed). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
This repository is public. The Android and webview repos that feed it are private, and only
compiled artifacts (
.aar,.aar.tmpl,.unitypackage,.bundle) plus accepted glue(
.cs,.jslib,.mm) are supposed to cross the boundary. A leak of native source here isirreversible, so the bar is "a routine mistake cannot leak it" — not "reviewers will notice".
What
scripts/check-proprietary-source.sh— denylist guard, bash 3.2 safe. Blocks*.java/*.kt(plus
.orig/.bak/~variants),*.gradle,*.pro,*.sh,*.toml,Rakefile/*.rake,the gradle wrapper,
.gitmodules,AndroidManifest.xmlandsrc/main/res/. Allowlists Unitygradle templates, the guard script itself, and content-free
*.meta..githooks/pre-commit— local gate. Enable withgit config core.hooksPath .githooks..github/workflows/no-proprietary-source.yml— the authoritative gate. Runs on every push andPR, and additionally rejects submodule gitlinks so the private repos can never be referenced
from here.
AGENTS.md— documents the boundary.Limits
The guard is path-based. It cannot catch native source pasted into an accepted file (
.cs,.md).Documented rather than fixed.
Verification
Guard block/allow paths exercised directly, and again through the cross-repo webview sync with a
planted
.javain the payload — the sync aborts. An adversarial review pass closed 10 bypassesbefore this branch.
🤖 Generated with Claude Code
https://claude.ai/code/session_01ShCMtnweyHuUEJQn2EH5d6