[jbecke]

Why

PR titles, bodies, and commit messages are public, and recent ones carried
personal contact details and links into support conversations. Agents also
followed the PR template's prompt to describe "the user request", which pulls
requesters and channels into the description. Pull request text should
describe the code change only, with any reason stated in general terms.

How it works

PR opened / edited / pushed
  -> PR Privacy Check (skips Dependabot)
       scan title, body, every commit message
         emails, phone numbers, @mentions, chat-channel names,
         support-tool links, Macro workspace item links (tasks allowed)
       any hit -> job fails, listing each match

Mentions and channel names are only matched outside code spans and fences,
where decorators, CSS colors, and shell comments look alike. Emails, phone
numbers, and links are matched everywhere. Names of people and customers
can't be matched by a pattern; the docs and reviewers cover those.

What

• tooling/xtask/crates/xtask_workflows: new pr_privacy_check workflow
  module and its script, generated to .github/workflows/pr-privacy-check.yml.
  Title and body reach the script through env vars; commits come from the PR
  API, so there is no checkout. It runs on edited, so fixing the description
  clears it.
• just pr-privacy [body-file] runs the same script on the branch's commits
  and, with PR_TITLE set, a draft title and body.
• .agents/skills/git/SKILL.md: a Privacy section covering what never goes
  into PR text, commits, comments, docs, or fixtures, with how to phrase the
  reason instead. The PR template's Why no longer asks for the user request.
• CLAUDE.md: a one-line guardrail pointing at the Privacy section.
• .agents/skills/audit/SKILL.md: the audit runs just pr-privacy and
  rereads PR text against the Privacy section.
• CONTRIBUTING.md: the same rule for human contributors.

Follow-ups

• Mark PR Privacy Check as a required status check in branch protection;
  until then it reports but does not block merging.

---

Generated by Claude Code

[coderabbitai]

Caution

Review failed

The pull request is closed.

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}