docs-privacy.yml

# docs-privacy.yml — docs-privacy gate. Required check name: "docs-privacy".
# Proves no private piloting marker leaks into the published docs/** (anti-regression
# at HEAD). check_docs_private_markers is decidable and prefix-anchored (METHOD section 6).
name: docs-privacy
on:
  pull_request:
  push:
    branches: [main]
permissions:
  contents: read
jobs:
  docs-privacy:
    name: docs-privacy
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version: "3.12"
      # Exact-version pin (determinism + CI<->local parity) via the runtime group.
      - run: python -m pip install --upgrade pip && pip install --group runtime
      # Gate command single-sourced in scripts/gates/docs-privacy.sh (S31).
      - run: bash scripts/gates/docs-privacy.sh