feat(security): public-repo PII gate (block customer names + secrets in PRs)

[LukasWodka]

Summary

A reusable workflow that blocks customer/partner names and known secrets from appearing in public-repo PRs. Follow-up to today's PII scrub (customer names — [redacted], [redacted], [redacted], [redacted], [redacted], plus a dead credential — were found leaked across 19 PR bodies in client/data-ingestors/model-zoo/cli).

How it works

On every PR in a public repo, scans the title + body + commit messages against a denylist. Fails the PR if any term matches.

The denylist never appears in source. It lives only in the org Actions secret PII_DENYLIST — so this public workflow file can't itself leak the names it protects. Matches are reported generically (the matched term is never printed; the secret is masked in logs regardless).

• Inactive until activated — warns (doesn't block) until an admin sets the secret, so rolling out callers can't break PRs prematurely.
• Override a false positive with the pii-gate-override label (audit-visible).

Activation (one-time, org admin — @LukasWodka)

gh secret set PII_DENYLIST --org tracebloc --visibility all \
--body "[redacted],[redacted],[redacted],[redacted],[redacted],[redacted],[redacted],[redacted],[redacted],[redacted],[redacted],[redacted],[redacted]"

(Comma-separated, case-insensitive substring match. Excludes netmedgpt — that's an intentional public model name in model-zoo.)

Rollout

Caller workflows (public-pii-gate-caller.yml) are being added to each public repo via separate PRs. They reference this reusable @main, so this PR should promote to main first.

Test plan

• Merge + promote to main
• Set the PII_DENYLIST org secret (command above)
• Open a throwaway PR in a public repo with "[redacted]" in the body → gate should fail
• Add pii-gate-override label → gate should pass

🤖 Generated with Claude Code

[LukasWodka]

👋 Heads-up — Code review queue is at 31 / 30

Above the WIP limit. The team convention is to review existing PRs before opening new work.

Open PRs currently in Code review (oldest first):

• .github#57 — fix(fr-gate): pass items at or beyond the required stage · author: @aptracebloc · no reviewer assigned
• averaging-service#117 — refactor(averaging): per-framework weight-handling seam (WS-B B1) · author: @divyasinghds · no reviewer assigned
• averaging-service#118 — feat(averaging): trainable-only keyed-dict weight format (WS-C feat(fr-gate): promotion-shape guard — only the train promotes #104) · author: @divyasinghds · no reviewer assigned
• averaging-service#119 — fix(averaging): exact federated GaussianNB merge — usable + correct (WS-B B2, promote: cross-repo change guidance (develop -> main) #112) · author: @divyasinghds · no reviewer assigned
• backend#815 — chore(deps): bump cryptography from 47.0.0 to 48.0.1 · author: @dependabot · no reviewer assigned
• backend#825 — feat(#763): distribute authoritative feature_columns to edges (phase 1) · author: @aptracebloc · reviewer: @saadqbal
• backend#829 — feat(#817): failure surfaces a reason end-to-end + stuck-run reaper (WS6 I3/I4/I5/I8) · author: @saadqbal · no reviewer assigned
• cli#78 — fix(dataset rm): delete staging files from a uid-65532 pod, not jobs-manager (fix(kanban): an INVERTED anchor pair is unreadable, not "nothing deployed" (backend#1994) #259) · author: @LukasWodka · no reviewer assigned
• cli#79 — chore(schema): re-sync vendored ingest.v1.json from data-ingestors master · author: @LukasWodka · no reviewer assigned
• cli#80 — refactor(cli P1): CategorySpec registry — one source for category dispatch (promote: FR gate fail-closed (#71) to main #74) · author: @LukasWodka · no reviewer assigned

Pull from review before opening new work. (This is a nudge from the kanban WIP check, not a block.)

[saadqbal]

Retargeting this PR from `develop` → `main` and merging, to fix a live break: the per-repo callers (tracebloc/cli, tracebloc/data-ingestors) already reference `public-pii-gate.yml@main`, but this file isn't on `main` yet, so every PR's "Public PII gate" check ends as a 0-job startup failure and PII scanning is non-operational. `develop` is currently behind `main` (ahead 0 / behind 10), so merging to develop wouldn't resolve the callers. Tracking: #62.

[saadqbal]

Reviewed the reusable workflow: least-privilege read perms, denylist read only from the org secret, matched term never printed (no leak), exits 0 when PII_DENYLIST is unset (INACTIVE warn), audited override label. Publishing to main to restore the callers (cli, data-ingestors) that already reference @main. Tracking #62.