Danijel Martinek
f77e6ea881
Curated, product-agnostic snapshot of the post-story-04 tree: demo content deleted, auth-only reference feature, web-next shell, all gates green. Product-specific docs, ADRs 027-029, PRDs/epics/archive, editor library traces, and product naming are curated out; generic template repairs (coverage provider devDeps, root test:coverage script, live lint fixes, root-only release-please) are kept. See TEMPLATE.md for provenance, curation list, and usage. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016j8z4VHjedXDTjEDNg7qHK
29 lines
985 B
YAML
29 lines
985 B
YAML
# R31 — block sendDefaultPii: true from ever landing.
|
|
#
|
|
# This is a defense-in-depth gate: the privacy posture is also enforced by
|
|
# the centralized init helpers in core-shared/instrumentation/sentry/, but
|
|
# this grep makes any drift impossible to merge.
|
|
|
|
name: Sentry PII guard (R31)
|
|
|
|
on:
|
|
pull_request:
|
|
push:
|
|
branches: [main]
|
|
|
|
jobs:
|
|
pii-guard:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- name: Verify sendDefaultPii is never true
|
|
run: |
|
|
if grep -RIn --include='*.ts' --include='*.tsx' --include='*.mjs' --include='*.cjs' --include='*.js' \
|
|
--exclude-dir=node_modules --exclude-dir=.next --exclude-dir=dist --exclude-dir=.turbo \
|
|
-E 'sendDefaultPii\s*:\s*true' \
|
|
packages/ apps/; then
|
|
echo "::error::R31 violation — sendDefaultPii: true is forbidden anywhere in the repo."
|
|
exit 1
|
|
fi
|
|
echo "OK — no sendDefaultPii: true detected."
|