From 46cffe48790c543fd24815c4c93fc73dba65a14b Mon Sep 17 00:00:00 2001
From: TPTBusiness <tpt.requests@pm.me>
Date: Thu, 16 Apr 2026 07:47:24 +0200
Subject: [PATCH] fix(ci): fix closed-source asset check false positives in
 security workflow

- Remove git_ignore_folder/RD-Agent_workspace symlink from tracking
  (local symlink pointing to results/rd_agent_workspace, not for VCS)
- Rewrite closed-source check to use precise patterns:
  - grep -F for exact prefix matching (no regex metacharacter issues)
  - results/: allow README.md and .gitkeep, block everything else
  - .env: match only .env and .env.* files, not paths containing "env"
    (previously matched kaggle_environment.yaml, env.py, etc.)
  - Add explicit check for committed data files (*.db, *.h5, *.parquet, *.log)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 .github/workflows/security.yml       | 37 ++++++++++++++++++++--------
 git_ignore_folder/RD-Agent_workspace |  1 -
 2 files changed, 27 insertions(+), 11 deletions(-)
 delete mode 120000 git_ignore_folder/RD-Agent_workspace

diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index 3e8175ad..79663897 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -107,25 +107,42 @@ jobs:
       run: |
         echo "=== Verifying No Closed-Source Assets Committed ==="
 
-        CLOSED_PATTERNS=(
+        FOUND_CLOSED=0
+
+        # Exact directory prefixes that must never appear (use grep -F for literal matching)
+        EXACT_PREFIXES=(
           "git_ignore_folder/"
-          "results/"
-          ".env"
           "models/local/"
           "prompts/local/"
           "rdagent/scenarios/qlib/local/"
-          "*.db"
-          "*.log"
         )
-
-        FOUND_CLOSED=0
-        for pattern in "${CLOSED_PATTERNS[@]}"; do
-          if git ls-files | grep -q "$pattern"; then
-            echo "::error::Found closed-source asset: $pattern"
+        for prefix in "${EXACT_PREFIXES[@]}"; do
+          if git ls-files | grep -qF "$prefix"; then
+            echo "::error::Found closed-source asset: $prefix"
             FOUND_CLOSED=1
           fi
         done
 
+        # results/ — allow README.md and .gitkeep but nothing else
+        if git ls-files | grep -F "results/" | grep -qvE "results/README\.md|results/\.gitkeep"; then
+          echo "::error::Found closed-source asset: results/ (non-documentation file)"
+          git ls-files | grep -F "results/" | grep -vE "results/README\.md|results/\.gitkeep"
+          FOUND_CLOSED=1
+        fi
+
+        # .env files — match only .env and .env.* exactly, not paths containing "env"
+        if git ls-files | grep -qE "(^|/)\.env($|\.)"; then
+          echo "::error::Found closed-source asset: .env file"
+          FOUND_CLOSED=1
+        fi
+
+        # Binary / data files that must never be committed
+        if git ls-files | grep -qE "\.(db|h5|parquet|log)$"; then
+          echo "::error::Found data/log file committed (*.db, *.h5, *.parquet, *.log)"
+          git ls-files | grep -E "\.(db|h5|parquet|log)$"
+          FOUND_CLOSED=1
+        fi
+
         if [ $FOUND_CLOSED -eq 1 ]; then
           echo "CRITICAL: Closed-source assets must not be committed to the repository!"
           echo "Please remove them and add to .gitignore if needed."
diff --git a/git_ignore_folder/RD-Agent_workspace b/git_ignore_folder/RD-Agent_workspace
deleted file mode 120000
index 6c5f0b00..00000000
--- a/git_ignore_folder/RD-Agent_workspace
+++ /dev/null
@@ -1 +0,0 @@
-/home/nico/Predix/results/rd_agent_workspace
\ No newline at end of file