From 0427afd1422df2dfe321fc66a553daebb1ea2885 Mon Sep 17 00:00:00 2001 From: lukasWuttke <54042461+LukasWodka@users.noreply.github.com> Date: Thu, 6 Aug 2026 15:35:27 +0200 Subject: [PATCH] chore(ci): retire the public PII gate caller (backend#1409) Removes this repo's caller for the public PII gate. Lukas's decision, 2026-08-06: retire the gate for now rather than leave it in place undeployed. WHY. The gate has never had a denylist. PII_DENYLIST does not exist as an org Actions secret and never has, so the workflow correctly failed closed on every PR - "an inactive guard must be visible as red, not invisible as green", as its own header puts it. Applied to a secret that was never provisioned, that produced a permanent red across all 7 public repos which blocked nothing: 24 open PRs carried it, and the whole org - this author included - had learned to filter it out. A check that is red on every PR is not fail-closed; it is off with extra steps, and it would be indistinguishable from noise on the day it went red for a real reason. WHAT LAPSES, stated plainly. The gate grepped PR title + body + every commit message against a private list of customer/partner names, on public repos only. It never read code, diffs or filenames, and detected no PII patterns - secrets in code remain gitleaks' job. So what lapses is the mechanical backstop for CLAUDE.md's rule that internal work and customer mentions never go in a public repo. That rule still stands and is now enforced by review alone. The reusable workflow and its selftest stay in tracebloc/.github, dormant with no callers. Restoring is three steps: set the org secret, restore this file, flip the inventory entry back to required. Checklist and the denylist-content caveat are on backend#1409. Not required on any branch, so this removes no merge gate. --- .github/workflows/public-pii-gate-caller.yml | 14 -------------- 1 file changed, 14 deletions(-) delete mode 100644 .github/workflows/public-pii-gate-caller.yml diff --git a/.github/workflows/public-pii-gate-caller.yml b/.github/workflows/public-pii-gate-caller.yml deleted file mode 100644 index 4af6016..0000000 --- a/.github/workflows/public-pii-gate-caller.yml +++ /dev/null @@ -1,14 +0,0 @@ -name: Public PII gate - -# Per-repo caller for the public-repo PII gate. Blocks PRs whose title/body/ -# commits contain a denylisted customer/partner name or known secret. -# Logic lives in tracebloc/.github/.github/workflows/public-pii-gate.yml. - -on: - pull_request: - types: [opened, edited, reopened, synchronize, labeled, unlabeled] - -jobs: - pii-gate: - uses: tracebloc/.github/.github/workflows/public-pii-gate.yml@main - secrets: inherit