Uh oh!
There was an error while loading. Please reload this page.
chore(ci): retire this repo's public PII gate caller (backend#1409) - #182
Merged
Conversation
Removes this repo's caller for the public PII gate. Lukas's decision, 2026-08-06: retire the gate for now rather than leave it in place undeployed. WHY. The gate has never had a denylist. PII_DENYLIST does not exist as an org Actions secret and never has, so the workflow correctly failed closed on every PR - "an inactive guard must be visible as red, not invisible as green", as its own header puts it. Applied to a secret that was never provisioned, that produced a permanent red across all 7 public repos which blocked nothing: 24 open PRs carried it, and the whole org - this author included - had learned to filter it out. A check that is red on every PR is not fail-closed; it is off with extra steps, and it would be indistinguishable from noise on the day it went red for a real reason. WHAT LAPSES, stated plainly. The gate grepped PR title + body + every commit message against a private list of customer/partner names, on public repos only. It never read code, diffs or filenames, and detected no PII patterns - secrets in code remain gitleaks' job. So what lapses is the mechanical backstop for CLAUDE.md's rule that internal work and customer mentions never go in a public repo. That rule still stands and is now enforced by review alone. The reusable workflow and its selftest stay in tracebloc/.github, dormant with no callers. Restoring is three steps: set the org secret, restore this file, flip the inventory entry back to required. Checklist and the denylist-content caveat are on backend#1409. Not required on any branch, so this removes no merge gate.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Retires this repo's public-PII-gate caller. Lukas's decision, 2026-08-06: remove the gate for now rather than leave it in place undeployed.
Why
PII_DENYLISThas never existed as an org secret, so the gate correctly failed closed on every PR — "an inactive guard must be visible as red, not invisible as green", per its own header. Applied to a secret that was never provisioned, that produced a permanent red across all 7 public repos that blocked nothing: 24 open PRs carried it, and the org — me included — had learned to filter it out. A check that is red on every PR is not fail-closed; it is off with extra steps, and it would have been indistinguishable from noise the day it went red for a real reason.What lapses, stated plainly
The gate grepped PR title + body + every commit message against a private list of customer/partner names, on public repos only. It never read code, diffs or filenames, and detected no PII patterns — secrets in code remain gitleaks' job. So what lapses is the mechanical backstop for CLAUDE.md's "internal work and customer mentions never go in a public repo". That rule still stands; it is now enforced by review alone.
Reversible
The reusable workflow and its selftest stay in
tracebloc/.github, dormant with no callers. Restoring is three steps: set the org secret, restore this file, flip the inventory entry back torequired. Checklist and the denylist-content caveat are on backend#1409.Not required on any branch, so this removes no merge gate. Parent backend#1405.
Note
Low Risk
Single-file deletion of a non-required CI caller; no application or auth logic changes, only less automation on PR metadata scanning for this repo.
Overview
Removes
.github/workflows/public-pii-gate-caller.yml, which on every pull request invoked the org reusablepublic-pii-gate.ymlto scan PR title, body, and commit messages againstPII_DENYLIST.PRs in tracebloc/.github will no longer trigger that check. The reusable workflow and its selftest under
.github/workflows/are unchanged and can still be called from other public repos or re-wired later by restoring this caller and provisioning the org secret.Per the PR rationale, the gate was effectively always red without a denylist secret and was not a required status check, so dropping the caller clears persistent noise without removing a merge blocker on this repo.
Reviewed by Cursor Bugbot for commit 248e56b. Bugbot is set up for automated code reviews on this repo. Configure here.