fix(ci): fix closed-source asset check false positives in security workflow

- Remove git_ignore_folder/RD-Agent_workspace symlink from tracking
  (local symlink pointing to results/rd_agent_workspace, not for VCS)
- Rewrite closed-source check to use precise patterns:
  - grep -F for exact prefix matching (no regex metacharacter issues)
  - results/: allow README.md and .gitkeep, block everything else
  - .env: match only .env and .env.* files, not paths containing "env"
    (previously matched kaggle_environment.yaml, env.py, etc.)
  - Add explicit check for committed data files (*.db, *.h5, *.parquet, *.log)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.github/workflows/security.yml

@@ -107,25 +107,42 @@ jobs:
       run: |
         echo "=== Verifying No Closed-Source Assets Committed ==="
 
-        CLOSED_PATTERNS=(
+        FOUND_CLOSED=0
+
+        # Exact directory prefixes that must never appear (use grep -F for literal matching)
+        EXACT_PREFIXES=(
           "git_ignore_folder/"
-          "results/"
-          ".env"
           "models/local/"
           "prompts/local/"
           "rdagent/scenarios/qlib/local/"
-          "*.db"
-          "*.log"
         )
-
-        FOUND_CLOSED=0
-        for pattern in "${CLOSED_PATTERNS[@]}"; do
-          if git ls-files | grep -q "$pattern"; then
-            echo "::error::Found closed-source asset: $pattern"
+        for prefix in "${EXACT_PREFIXES[@]}"; do
+          if git ls-files | grep -qF "$prefix"; then
+            echo "::error::Found closed-source asset: $prefix"
             FOUND_CLOSED=1
           fi
         done
 
+        # results/ — allow README.md and .gitkeep but nothing else
+        if git ls-files | grep -F "results/" | grep -qvE "results/README\.md|results/\.gitkeep"; then
+          echo "::error::Found closed-source asset: results/ (non-documentation file)"
+          git ls-files | grep -F "results/" | grep -vE "results/README\.md|results/\.gitkeep"
+          FOUND_CLOSED=1
+        fi
+
+        # .env files — match only .env and .env.* exactly, not paths containing "env"
+        if git ls-files | grep -qE "(^|/)\.env($|\.)"; then
+          echo "::error::Found closed-source asset: .env file"
+          FOUND_CLOSED=1
+        fi
+
+        # Binary / data files that must never be committed
+        if git ls-files | grep -qE "\.(db|h5|parquet|log)$"; then
+          echo "::error::Found data/log file committed (*.db, *.h5, *.parquet, *.log)"
+          git ls-files | grep -E "\.(db|h5|parquet|log)$"
+          FOUND_CLOSED=1
+        fi
+
         if [ $FOUND_CLOSED -eq 1 ]; then
           echo "CRITICAL: Closed-source assets must not be committed to the repository!"
           echo "Please remove them and add to .gitignore if needed."

git_ignore_folder/RD-Agent_workspace

@@ -1 +0,0 @@
-/home/nico/Predix/results/rd_agent_workspace