From 824101e0eebf44a5372401b05f7b68aa762835c9 Mon Sep 17 00:00:00 2001 From: David Bon-Salomon <62355986+David-BS@users.noreply.github.com> Date: Wed, 8 Jul 2026 12:41:10 +0200 Subject: [PATCH] ci: add docs-privacy gate (check_docs_private_markers on docs/**) --- .github/workflows/docs-privacy.yml | 23 +++++++++++++++++++++++ scripts/gates/docs-privacy.sh | 5 +++++ 2 files changed, 28 insertions(+) create mode 100644 .github/workflows/docs-privacy.yml create mode 100644 scripts/gates/docs-privacy.sh diff --git a/.github/workflows/docs-privacy.yml b/.github/workflows/docs-privacy.yml new file mode 100644 index 0000000..32683d1 --- /dev/null +++ b/.github/workflows/docs-privacy.yml @@ -0,0 +1,23 @@ +# docs-privacy.yml — docs-privacy gate. Required check name: "docs-privacy". +# Proves no private piloting marker leaks into the published docs/** (anti-regression +# at HEAD). check_docs_private_markers is decidable and prefix-anchored (METHOD section 6). +name: docs-privacy +on: + pull_request: + push: + branches: [main] +permissions: + contents: read +jobs: + docs-privacy: + name: docs-privacy + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 + with: + python-version: "3.12" + # Exact-version pin (determinism + CI<->local parity) via the runtime group. + - run: python -m pip install --upgrade pip && pip install --group runtime + # Gate command single-sourced in scripts/gates/docs-privacy.sh (S31). + - run: bash scripts/gates/docs-privacy.sh diff --git a/scripts/gates/docs-privacy.sh b/scripts/gates/docs-privacy.sh new file mode 100644 index 0000000..81c81c4 --- /dev/null +++ b/scripts/gates/docs-privacy.sh @@ -0,0 +1,5 @@ +#!/usr/bin/env bash +# Gate command for the `docs-privacy` CI check, single-sourced (METHOD section 6 / S31). +# Proves no private piloting marker leaks into docs/** (check_docs_private_markers). +set -e +python scripts/check_docs_private_markers.py