Block local author identity in public-boundary scanner

durable-workflow-ops · durable-workflow-ops · commit bfad678bc4e8 · 2026-04-22T19:14:05.000Z
Reject commit metadata whose author or committer email uses the
internal development domain so public repos cannot publish commits
tagged with the local build identity.
diff --git a/scripts/check-public-boundary.sh b/scripts/check-public-boundary.sh
@@ -31,6 +31,7 @@ metadata_patterns=(
   "$(pattern_from_hex 4c6f6f702d49443a)"
   "$(pattern_from_hex 2e746d702f6c6f6f70732f)"
   "$(pattern_from_hex 6c6f6f702d72756e6e6572)"
+  "$(pattern_from_hex 4064757261626c652d776f726b666c6f772e6c6f63616c)"
 )
 
 pathspec=(

Original file line number	Diff line number	Diff line change
`@@ -31,6 +31,7 @@ metadata_patterns=(`
`31`	`31`	`"$(pattern_from_hex 4c6f6f702d49443a)"`
`32`	`32`	`"$(pattern_from_hex 2e746d702f6c6f6f70732f)"`
`33`	`33`	`"$(pattern_from_hex 6c6f6f702d72756e6e6572)"`
	`34`	`+ "$(pattern_from_hex 4064757261626c652d776f726b666c6f772e6c6f63616c)"`
`34`	`35`	`)`
`35`	`36`
`36`	`37`	`pathspec=(`