Require Investigation privacy scan in the main branch ruleset

[coneilen]

Requested change

Update the active MainProtector repository ruleset for the default branch to require the GitHub Actions check Investigation privacy scan (use this exact check context).

Why this is needed

PR #497 added changed-path CI classification so platform validation runs only when relevant files change. The separate Investigation privacy scan protects parity ledgers, research notes, evidence, screenshots, and other files under investigation/ from accidental disclosure of sensitive information.

The scan already runs successfully in CI, but it is not currently required. This means a pull request could merge despite the privacy scan failing or not completing. Making it required preserves the CI optimization while ensuring investigation and parity-document changes cannot bypass privacy validation.

Administrator steps

1. Open Repository settings → Rules → Rulesets.
2. Edit the active MainProtector ruleset (ruleset ID 20328158), which targets ~DEFAULT_BRANCH.
3. Under required status checks, add Investigation privacy scan.
   • Exact context: Investigation privacy scan
   • GitHub Actions integration/app ID: 15368
4. Preserve every existing rule and required check.
5. Save the ruleset.
6. Verify the exact check context is required on a subsequent pull request.

Existing required checks to preserve

• DCO sign-off
• Linux build
• macos
• validate
• windows-spikes
• windows-shell
• Deterministic hardening (windows-2022, pwsh)
• Deterministic hardening (windows-2025, pwsh)

Evidence

• PR ci: skip platform validation for unrelated pull request paths #497 introduced the path-aware CI behavior: ci: skip platform validation for unrelated pull request paths #497
• Investigation privacy scan completed successfully on the final PR ci: skip platform validation for unrelated pull request paths #497 head.
• The check already exists and runs in CI; no workflow or product-code change is requested here.
• An attempted ruleset update using the current contributor account failed because it has push access but not repository administrator permission.

Acceptance criteria

• Investigation privacy scan appears in MainProtector as a required status check.
• All eight existing required checks remain required.
• No other ruleset behavior changes.
• A subsequent pull request shows the exact check as required and reports it successfully.

[coneilen]

Verified complete. Closing.

Ruleset state (live)

GET repos/scgopi/GraphCode/rulesets/20328158 -> name=MainProtector target=branch enforcement=active, with nine required status checks, all under GitHub Actions app 15368:

DCO sign-off
Linux build
macos
validate
windows-spikes
windows-shell
Deterministic hardening (windows-2022, pwsh)
Deterministic hardening (windows-2025, pwsh)
Investigation privacy scan     <- added

The exact context Investigation privacy scan is present, and all eight pre-existing checks are preserved. No other ruleset rules changed.

Enforcement confirmed on a real pull request

Acceptance criterion 4 asked for proof that a subsequent PR shows the check as required. Queried via GraphQL isRequired(pullRequestNumber: 500) against the head commit of #500:

Investigation privacy scan   required=true   SUCCESS

All nine contexts report required=true on that PR, so this is enforcement observed on a live PR rather than inferred from settings.

The scan itself was verified to work, not just to pass

A check that can only ever pass would satisfy the ruleset while protecting nothing, so both directions were exercised locally against Tools/windows/validate.ps1 -Task privacy:

• GREEN — clean tree: Privacy checks passed, exit 0.
• RED — planted a repo-root absolute path into a temporary investigation/*.md file: exit 1, failing at validate.ps1:708 with Environment-specific content matched '<repo root>' in ...\investigation\privacy-probe-temp.md.

The probe file was removed afterwards and git status --porcelain is clean.

Scope note

This confirms the scan detects environment-specific paths in content-scanned text files. Per its implementation it content-scans .md/.swift/.c/.py/.ps1/.resolved/.json/.txt; binary files such as .png are checked for non-default NTFS streams but are not content-scanned. That is existing designed behavior and not a regression — noting it so the guarantee is not read as broader than it is.

All acceptance criteria met.