chore(guard): sync vendored public-repo-guard to canonical

WA
16d ago
+9-1

Syncs the vendored public-repo-guard trio to the canonical source in wave-foundation/scaffolder/public-repo-guard.

  • adds the internal-ip leak rule (Tailscale-CGNAT 100.64.0.0/10), lockstep with the pre-publish mirror gate
  • reconciles accumulated drift in the vendored copy

Each changed file is byte-for-byte identical to canonical (verified by git blob SHA). The repo's own Secrets + content policy gate re-scans this PR.

🤖 Generated with Claude Code

Open in Devin Review

[!NOTE]

Update public-repo-guard workflow to use actions/checkout v7 without persisted credentials

Syncs public-repo-guard.yml to the canonical version. Upgrades actions/checkout from v5.0.1 to v7.0.0 and sets persist-credentials: false so the GITHUB_TOKEN is no longer stored in the repository's Git config after checkout.

Macroscope summarized 2dff537.

Summary by cubic

Synced the vendored public-repo-guard to the canonical wave-foundation/scaffolder/public-repo-guard and hardened the workflow. Adds the internal-IP leak rule for Tailscale CGNAT (100.64.0.0/10), and updates to actions/checkout@v7 with persist-credentials: false to reduce credential exposure during gitleaks scans.