olympus/.github/workflows/guard.yml at main · Netis/olympus · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
name: olympus-guard

# Reusable hygiene gate. No LLM, no self-hosted runner — pure linters that
# catch the mechanical PR failure classes olympus was built around:
#   - leakage : no private IP / key material / machine path in tracked files
#   - secrets : every referenced GitHub secret is actually provisioned
#   - secret-values : provisioned secret values are sane (non-empty, not "-")
#
# Consumer wrapper (triggers on pull_request + push):
#   jobs:
#     guard:
#       uses: Netis/olympus/.github/workflows/guard.yml@v0.1.0
#       secrets: inherit          # only needed if check-secrets queries the API
#
# Runs on GitHub-hosted ubuntu; safe for fork PRs (read-only).

on:
  workflow_call:
    inputs:
      olympus_repo:
        type: string
        default: Netis/olympus
      olympus_ref:
        type: string
        default: main
      run_secret_checks:
        description: Also verify referenced secrets are provisioned + sane (needs a token).
        type: boolean
        default: false
    secrets:
      AGENT_GH_TOKEN: { required: false }

jobs:
  guard:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout consumer repo
        uses: actions/checkout@v4

      - name: Fetch olympus scripts
        uses: actions/checkout@v4
        with:
          repository: ${{ inputs.olympus_repo }}
          ref: ${{ inputs.olympus_ref }}
          token: ${{ secrets.AGENT_GH_TOKEN || github.token }}
          path: _agentops

      - name: leakage gate (no internal infra in tracked files)
        run: bash _agentops/scripts/lint/check-leakage.sh

      - name: secret-reference gate
        if: ${{ inputs.run_secret_checks }}
        env:
          GH_TOKEN: ${{ secrets.AGENT_GH_TOKEN || github.token }}
        run: bash _agentops/scripts/lint/check-secrets.sh "$GITHUB_REPOSITORY"

      - name: secret-value sanity gate
        if: ${{ inputs.run_secret_checks }}
        env:
          GH_TOKEN: ${{ secrets.AGENT_GH_TOKEN || github.token }}
        run: bash _agentops/scripts/lint/check-secret-values.sh "$GITHUB_REPOSITORY"