fix: upgrade shell-quote to 1.8.4 (CVE-2026-9277) #94
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CSI data policy (ADR-299) | |
| # ADR-299 repository CSI data-incident guard. Fails when CSI-format files | |
| # (*.csi.jsonl / *.csi.meta.json) or oversized JSONL captures are tracked in | |
| # git. Raw CSI is person data and must never be committed (CLAUDE.md, ADR-299). | |
| # | |
| # NOTE: the tree currently still contains the pre-existing incident recordings | |
| # under data/recordings/ and v2/data/recordings/, whose removal is gated on | |
| # data-owner sign-off (ADR-299). Until they are removed this job is EXPECTED to | |
| # fail, and that failure documents the incident. To make it green in a | |
| # follow-up without weakening the guard for NEW files, set CSI_POLICY_BASELINE | |
| # to a file listing the acknowledged paths (see the script header). | |
| # | |
| # Checker: scripts/csi-data-policy-check.sh Run locally: bash the same script. | |
| on: | |
| push: | |
| branches: | |
| - main | |
| - master | |
| pull_request: | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| jobs: | |
| csi-data-policy: | |
| name: CSI data policy check | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 | |
| with: | |
| persist-credentials: false | |
| - name: Self-test the policy checker (deterministic, offline) | |
| run: bash scripts/csi-data-policy-check.sh --self-test | |
| - name: Enforce CSI data policy on tracked files | |
| # CSI_POLICY_BASELINE can point at an acknowledged-paths file once the | |
| # owner remediates the tree; unset here so a regression fails loudly. | |
| run: bash scripts/csi-data-policy-check.sh --tracked | |
| - name: Summarize result | |
| if: always() | |
| run: | | |
| { | |
| echo '### CSI data policy (ADR-299)' | |
| echo '' | |
| echo '```' | |
| bash scripts/csi-data-policy-check.sh --tracked 2>&1 || true | |
| echo '```' | |
| } >> "$GITHUB_STEP_SUMMARY" |