From e5bb1bae6a86938620595d7c06915aaa28a7a400 Mon Sep 17 00:00:00 2001 From: Randall Stillwell Date: Wed, 27 May 2026 08:45:06 -0500 Subject: [PATCH] ci: allowlist server-only lib/scan-gemini.js in LLM key gate MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The scan pipeline helper lives under lib/ but is imported exclusively from pages/api/scan/identify — exclude it from the client-side URL scan. Co-authored-by: Cursor --- .github/workflows/ci.yml | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index c8834a5..50d36c3 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -174,9 +174,23 @@ jobs: done exit 1 fi + # lib/ may hold server-only helpers (e.g. scan-gemini.js) imported only from pages/api/. + SERVER_ONLY=( + lib/scan-gemini.js + ) LLM_PATTERN='generativelanguage\.googleapis\.com|api\.openai\.com' FOUND=() while IFS= read -r file; do + skip=false + for so in "${SERVER_ONLY[@]}"; do + if [ "$file" = "$so" ]; then + skip=true + break + fi + done + if [ "$skip" = true ]; then + continue + fi if grep -qE "$LLM_PATTERN" "$file" 2>/dev/null; then FOUND+=("$file") fi